Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

644 results · page 2 of 13

Jun 5, 2026SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilityCVE-2026-28318 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 7.5
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Product
Serv-U
On CISA’s list since
Jun 5, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Jun 1, 2026Oracle WebLogic Server Unspecified VulnerabilityCVE-2024-21182 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
Product
WebLogic Server
On CISA’s list since
Jun 1, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
May 27, 2026Nx Console Embedded Malicious Code VulnerabilityCVE-2026-48027 · Other software · Nx · reported by GitHubExploitedRansomwareCritical 9.3
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Product
Nx Console
On CISA’s list since
May 27, 2026 (federal fix deadline Jun 10, 2026)
What to do
Attackers are using this now. Install Nx’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 26, 2026LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCVE-2026-48172 · Other software · LiteSpeed · reported by MITREExploitedCritical 10
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Product
cPanel Plugin
On CISA’s list since
May 26, 2026 (federal fix deadline May 29, 2026)
What to do
Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.litespeedtech.com litespeedtech.com
May 14, 2026Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCVE-2026-20182 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
Product
Catalyst SD-WAN
On CISA’s list since
May 14, 2026 (federal fix deadline May 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
May 7, 2026Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityCVE-2026-6973 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 7, 2026 (federal fix deadline May 10, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com cisa.gov
Apr 24, 2026SimpleHelp Path Traversal VulnerabilityCVE-2024-57728 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.2
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 24, 2026SimpleHelp Missing Authorization VulnerabilityCVE-2024-57726 · Other software · SimpleHelp · reported by MITREExploitedRansomwareCritical 9.9
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 20, 2026Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCVE-2026-20122 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.4
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Product
Catalyst SD-WAN Manger
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCVE-2026-20128 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 8, 2026Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityCVE-2026-1340 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Apr 8, 2026 (federal fix deadline Apr 11, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Apr 1, 2026Google Dawn Use-After-Free VulnerabilityCVE-2026-5281 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Dawn
On CISA’s list since
Apr 1, 2026 (federal fix deadline Apr 15, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 30, 2026Citrix NetScaler Out-of-Bounds Read VulnerabilityCVE-2026-3055 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.3
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
Product
NetScaler
On CISA’s list since
Mar 30, 2026 (federal fix deadline Apr 2, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com labs.watchtowr.com
Mar 20, 2026Apple Multiple Products Improper Locking VulnerabilityCVE-2025-43510 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 20, 2026Apple Multiple Products Classic Buffer Overflow VulnerabilityCVE-2025-43520 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 20, 2026Apple Multiple Products Buffer Overflow VulnerabilityCVE-2025-31277 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 13, 2026Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCVE-2026-3910 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 13, 2026Google Skia Out-of-Bounds Write VulnerabilityCVE-2026-3909 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Product
Skia
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 5, 2026Hikvision Multiple Products Improper Authentication VulnerabilityCVE-2017-7921 · Network & remote access · Hikvision · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hikvision.com securityfocus.com
Mar 5, 2026Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityCVE-2021-22681 · Other software · Rockwell · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Rockwell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.cisa.gov us-cert.cisa.gov
Mar 5, 2026Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCVE-2021-30952 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com lists.fedoraproject.org
Mar 5, 2026Apple iOS and iPadOS Use-After-Free VulnerabilityCVE-2023-41974 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 5, 2026Apple Multiple products Use-After-Free VulnerabilityCVE-2023-43000 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 3, 2026Qualcomm Multiple Chipsets Memory Corruption VulnerabilityCVE-2026-21385 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.
Product
Multiple Chipsets
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com source.android.com
Feb 25, 2026Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCVE-2026-20127 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Product
Catalyst SD-WAN Controller and Manager
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Feb 24, 2026Soliton Systems K.K FileZen OS Command Injection VulnerabilityCVE-2026-25108 · Other software · Soliton Systems K.K · reported by vultures@jpcert.or.jpExploitedHigh 8.7
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
Product
FileZen
On CISA’s list since
Feb 24, 2026 (federal fix deadline Mar 17, 2026)
What to do
Attackers are using this now. Install Soliton Systems K.K’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp soliton.co.jp
Feb 17, 2026TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2024-7694 · Other software · TeamT5 · reported by twcert@cert.org.twExploitedHigh 7.2
TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
Product
ThreatSonar Anti-Ransomware
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install TeamT5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
Feb 17, 2026Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Feb 13, 2026BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCVE-2026-1731 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedRansomwareCritical 9.9
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Product
Remote Support (RS) and Privileged Remote Access (PRA)
On CISA’s list since
Feb 13, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com beyondtrust.com
Feb 12, 2026Apple Multiple Buffer Overflow VulnerabilityCVE-2026-20700 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
Product
Multiple Products
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 10, 2026Microsoft Windows Improper Privilege Management VulnerabilityCVE-2026-21533 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Jan 29, 2026Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityCVE-2026-1281 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Jan 29, 2026 (federal fix deadline Feb 1, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Jan 27, 2026Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-24858 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Product
Multiple Products
On CISA’s list since
Jan 27, 2026 (federal fix deadline Jan 30, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cert-portal.siemens.com
Jan 26, 2026SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2025-52691 · Other software · SmarterTools · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4ExploitedRansomwareCritical 10
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csa.gov.sg github.com
Jan 22, 2026Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion VulnerabilityCVE-2025-68645 · Email & office · Synacor · reported by MITREExploitedHigh 8.8
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Jan 7, 2026Hewlett Packard Enterprise (HPE) OneView Code Injection VulnerabilityCVE-2025-37164 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comExploitedCritical 10
Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.
Product
OneView
On CISA’s list since
Jan 7, 2026 (federal fix deadline Jan 28, 2026)
What to do
Attackers are using this now. Install Hewlett Packard Enterprise (HPE)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.hpe.com github.com
Dec 29, 2025MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency VulnerabilityCVE-2025-14847 · Other software · MongoDB · reported by cna@mongodb.comExploitedHigh 8.7
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
Product
MongoDB and MongoDB Server
On CISA’s list since
Dec 29, 2025 (federal fix deadline Jan 19, 2026)
What to do
Attackers are using this now. Install MongoDB’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jira.mongodb.org openwall.com
Dec 17, 2025Cisco Multiple Products Improper Input Validation VulnerabilityCVE-2025-20393 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.
Product
Multiple Products
On CISA’s list since
Dec 17, 2025 (federal fix deadline Dec 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Dec 16, 2025Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityCVE-2025-59718 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
Product
Multiple Products
On CISA’s list since
Dec 16, 2025 (federal fix deadline Dec 23, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com arcticwolf.com
Dec 15, 2025Apple Multiple Products Use-After-Free WebKit VulnerabilityCVE-2025-43529 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Dec 15, 2025 (federal fix deadline Jan 5, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Dec 12, 2025Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2018-4063 · Other software · Sierra Wireless · reported by talos-cna@cisco.comExploitedHigh 8.8
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
AirLink ALEOS
On CISA’s list since
Dec 12, 2025 (federal fix deadline Jan 2, 2026)
What to do
Attackers are using this now. Install Sierra Wireless’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Dec 12, 2025Google Chromium Out of Bounds Memory Access VulnerabilityCVE-2025-14174 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium
On CISA’s list since
Dec 12, 2025 (federal fix deadline Jan 2, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Dec 3, 2025OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2021-26828 · Other software · OpenPLC · reported by MITREExploitedHigh 8.8
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Product
ScadaBR
On CISA’s list since
Dec 3, 2025 (federal fix deadline Dec 24, 2025)
What to do
Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.scadabr.com.br packetstormsecurity.com
Dec 2, 2025Android Framework Privilege Escalation VulnerabilityCVE-2025-48572 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
Product
Framework
On CISA’s list since
Dec 2, 2025 (federal fix deadline Dec 23, 2025)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog android.googlesource.com source.android.com
Nov 21, 2025Oracle Fusion Middleware Missing Authentication for Critical Function VulnerabilityCVE-2025-61757 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Product
Fusion Middleware
On CISA’s list since
Nov 21, 2025 (federal fix deadline Dec 12, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com isc.sans.edu
Nov 19, 2025Google Chromium V8 Type Confusion VulnerabilityCVE-2025-13223 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
Product
Chromium V8
On CISA’s list since
Nov 19, 2025 (federal fix deadline Dec 10, 2025)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Nov 10, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21042 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 8.8
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Product
Mobile Devices
On CISA’s list since
Nov 10, 2025 (federal fix deadline Dec 1, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com unit42.paloaltonetworks.com
Nov 4, 2025Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityCVE-2025-11371 · Other software · Gladinet · reported by 5dacb0b8-2277-4717-899c-254586fe4912ExploitedHigh 7.5
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
Product
CentreStack and Triofox
On CISA’s list since
Nov 4, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huntress.com centrestack.com
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 7.8
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Product
VMware Aria Operations and VMware Tools
On CISA’s list since
Oct 30, 2025 (federal fix deadline Nov 20, 2025)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com openwall.com
Oct 20, 2025Apple Multiple Products Unspecified VulnerabilityCVE-2022-48503 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Products
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.