Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

151 results · page 2 of 4

Dec 4, 2023Apple Multiple Products WebKit Memory Corruption VulnerabilityCVE-2023-42917 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Dec 4, 2023 (federal fix deadline Dec 25, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Dec 4, 2023Apple Multiple Products WebKit Out-of-Bounds Read VulnerabilityCVE-2023-42916 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.5
Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Dec 4, 2023 (federal fix deadline Dec 25, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Nov 16, 2023Sophos Web Appliance Command Injection VulnerabilityCVE-2023-1671 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
Product
Web Appliance
On CISA’s list since
Nov 16, 2023 (federal fix deadline Dec 7, 2023)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sophos.com
Oct 5, 2023Apple iOS and iPadOS Kernel Privilege Escalation VulnerabilityCVE-2023-42824 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
Product
iOS and iPadOS
On CISA’s list since
Oct 5, 2023 (federal fix deadline Oct 26, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 25, 2023Apple Multiple Products Improper Certificate Validation VulnerabilityCVE-2023-41991 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 25, 2023Apple Multiple Products Kernel Privilege Escalation VulnerabilityCVE-2023-41992 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 25, 2023Apple Multiple Products WebKit Code Execution VulnerabilityCVE-2023-41993 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org security.netapp.com
Sep 13, 2023Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access VulnerabilityCVE-2023-20269 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 5
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
Product
Adaptive Security Appliance and Firepower Threat Defense
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 11, 2023Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow VulnerabilityCVE-2023-41064 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 11, 2023 (federal fix deadline Oct 2, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com support.apple.com
Sep 11, 2023Apple iOS, iPadOS, and watchOS Wallet Code Execution VulnerabilityCVE-2023-41061 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Sep 11, 2023 (federal fix deadline Oct 2, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Jul 26, 2023Apple Multiple Products Kernel Unspecified VulnerabilityCVE-2023-38606 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
Product
Multiple Products
On CISA’s list since
Jul 26, 2023 (federal fix deadline Aug 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jul 13, 2023Apple Multiple Products WebKit Code Execution VulnerabilityCVE-2023-37450 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Jul 13, 2023 (federal fix deadline Aug 3, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
Jun 23, 2023Apple Multiple Products Integer Overflow VulnerabilityCVE-2023-32434 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org support.apple.com
Jun 23, 2023Apple Multiple Products WebKit Memory Corruption VulnerabilityCVE-2023-32435 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 23, 2023Apple Multiple Products WebKit Type Confusion VulnerabilityCVE-2023-32439 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
May 22, 2023Apple Multiple Products WebKit Sandbox Escape VulnerabilityCVE-2023-32409 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.6
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 22, 2023Apple Multiple Products WebKit Out-of-Bounds Read VulnerabilityCVE-2023-28204 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.5
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
May 22, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-32373 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
Apr 17, 2023Apple macOS Use-After-Free VulnerabilityCVE-2019-8526 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
Product
macOS
On CISA’s list since
Apr 17, 2023 (federal fix deadline May 8, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 10, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-28205 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Apr 10, 2023 (federal fix deadline May 1, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 10, 2023Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write VulnerabilityCVE-2023-28206 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.6
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Apr 10, 2023 (federal fix deadline May 1, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 30, 2023Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityCVE-2021-30900 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 14, 2023Apple Multiple Products WebKit Type Confusion VulnerabilityCVE-2023-23529 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Dec 14, 2022Apple iOS Type Confusion VulnerabilityCVE-2022-42856 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Product
iOS
On CISA’s list since
Dec 14, 2022 (federal fix deadline Jan 4, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Dec 13, 2022Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCVE-2022-27518 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Product
Application Delivery Controller (ADC) and Gateway
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Oct 25, 2022Apple iOS and iPadOS Out-of-Bounds Write VulnerabilityCVE-2022-42827 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Oct 25, 2022 (federal fix deadline Nov 15, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 14, 2022Apple iOS, iPadOS, and macOS Remote Code Execution VulnerabilityCVE-2022-32917 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 14, 2022 (federal fix deadline Oct 5, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 8, 2022Apple iOS, iPadOS, and macOS Input Validation VulnerabilityCVE-2020-9934 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 25, 2022Apple iOS, macOS, watchOS Sandbox Bypass VulnerabilityCVE-2021-31010 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.5
In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
Product
iOS, macOS, watchOS
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 18, 2022Apple iOS and macOS Out-of-Bounds Write VulnerabilityCVE-2022-32894 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
Product
iOS and macOS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Aug 18, 2022Apple iOS and macOS Out-of-Bounds Write VulnerabilityCVE-2022-32893 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
Product
iOS and macOS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Jul 29, 2022Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityCVE-2022-26138 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.8
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Product
Confluence
On CISA’s list since
Jul 29, 2022 (federal fix deadline Aug 19, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog confluence.atlassian.com jira.atlassian.com
Jun 27, 2022Apple Multiple Products Use-After-Free VulnerabilityCVE-2019-8605 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 27, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2018-4344 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 27, 2022Apple iOS and iPadOS Buffer Overflow VulnerabilityCVE-2021-30983 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 27, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2020-3837 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 27, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2020-9907 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 24, 2022Apple iOS Information Disclosure VulnerabilityCVE-2016-4655 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com lists.apple.com
May 24, 2022Apple iOS Memory Corruption VulnerabilityCVE-2016-4656 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Apple iOS Webkit Memory Corruption VulnerabilityCVE-2016-4657 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow VulnerabilityCVE-2016-6366 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityCVE-2016-6367 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 23, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2021-30883 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
Product
Multiple Products
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2019-7286 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Product
Multiple Products
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Apple iOS Memory Corruption VulnerabilityCVE-2019-7287 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
Product
iOS
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Microsoft Windows AppX Deployment Service Privilege Escalation VulnerabilityCVE-2019-1130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Product
WhatsApp
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com facebook.com
May 23, 2022Microsoft Windows AppX Deployment Extensions Privilege Escalation VulnerabilityCVE-2019-1385 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com zerodayinitiative.com
May 4, 2022Apple Multiple Products Type Confusion VulnerabilityCVE-2021-1789 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.