Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

69 results · page 2 of 2

Sep 8, 2022Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityCVE-2018-13374 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 4.3
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Product
FortiOS and FortiADC
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Sep 8, 2022QNAP Photo Station Externally Controlled Reference VulnerabilityCVE-2022-27593 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
Product
Photo Station
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Jun 8, 2022QNAP Photo Station Improper Access Control VulnerabilityCVE-2019-7192 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
Product
Photo Station
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com qnap.com
Mar 31, 2022Dell dbutil Driver Insufficient Access Control VulnerabilityCVE-2021-21551 · Other software · Dell · reported by security_alert@emc.comExploitedHigh 8.8
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Product
dbutil Driver
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Mar 25, 2022QNAP Helpdesk Improper Access Control VulnerabilityCVE-2020-2506 · Network & remote access · QNAP Systems · reported by security@qnapsecurity.com.twExploitedHigh 7.3
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
Product
Helpdesk
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install QNAP Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 25, 2022Cisco Secure Access Control System Java Deserialization VulnerabilityCVE-2018-0147 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.
Product
Secure Access Control System (ACS)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 22, 2022Zabbix Frontend Improper Access Control VulnerabilityCVE-2022-23134 · Other software · Zabbix · reported by security@zabbix.comExploitedLow 3.7
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
Product
Frontend
On CISA’s list since
Feb 22, 2022 (federal fix deadline Mar 8, 2022)
What to do
Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.debian.org lists.fedoraproject.org
Jan 18, 2022Aviatrix Controller Unrestricted Upload of FileCVE-2021-40870 · Other software · Aviatrix · reported by MITREExploitedCritical 9.8
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Product
Aviatrix Controller
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com docs.aviatrix.com
Jan 10, 2022VMware vCenter Server Improper Access ControlCVE-2021-22017 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Product
vCenter Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Dec 10, 2021Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Product
Nexus Repository Manager
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.sonatype.com support.sonatype.com
Nov 3, 2021Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityCVE-2020-26919 · Network & remote access · NETGEAR · reported by MITREExploitedCritical 9.8
Netgear JGS516PE devices contain a missing function level access control vulnerability.
Product
JGS516PE Devices
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.netgear.com kb.netgear.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCVE-2019-19781 · Network & remote access · Citrix · reported by MITREExploitedRansomwareCritical 9.8
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityCVE-2021-22986 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Product
BIG-IP and BIG-IQ Centralized Management
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityCVE-2020-8193 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8195 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8196 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 4.3
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.