Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

229 results · page 2 of 5

Oct 2, 2025Smartbedded Meteobridge Command Injection VulnerabilityCVE-2025-4008 · Other software · Smartbedded · reported by research@onekey.comExploitedHigh 8.7
Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
Product
Meteobridge
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Smartbedded’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.meteohub.de onekey.com
Sep 29, 2025Libraesva Email Security Gateway Command Injection VulnerabilityCVE-2025-59689 · Other software · Libraesva · reported by MITREExploitedMedium 6.1
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
Product
Email Security Gateway
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Libraesva’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.libraesva.com libraesva.com
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-Link · reported by f23511db-6c3e-4e32-a477-6aa17d310630ExploitedHigh 8.6
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Aug 25, 2025Citrix Session Recording Improper Privilege Management VulnerabilityCVE-2024-8068 · Network & remote access · Citrix · reported by secure@citrix.comExploitedMedium 5.1
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Product
Session Recording
On CISA’s list since
Aug 25, 2025 (federal fix deadline Sep 15, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 18, 2025Trend Micro Apex One OS Command Injection VulnerabilityCVE-2025-54948 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.4
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Product
Apex One
On CISA’s list since
Aug 18, 2025 (federal fix deadline Sep 8, 2025)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com cisa.gov
Aug 13, 2025N-able N-Central Command Injection VulnerabilityCVE-2025-8876 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
Product
N-Central
On CISA’s list since
Aug 13, 2025 (federal fix deadline Aug 20, 2025)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.n-able.com cisa.gov
Aug 12, 2025Microsoft Internet Explorer Resource Management Errors VulnerabilityCVE-2013-3893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
Aug 5, 2025D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityCVE-2020-25079 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DCS-2530L and DCS-2670L Devices
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com twitter.com
Jul 7, 2025PHPMailer Command Injection VulnerabilityCVE-2016-10033 · Websites & servers · PHP · reported by MITREExploitedCritical 9.8
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Product
PHPMailer
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install PHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 17, 2025Linux Kernel Improper Ownership Management VulnerabilityCVE-2023-0386 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Product
Kernel
On CISA’s list since
Jun 17, 2025 (federal fix deadline Jul 8, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com git.kernel.org
Jun 16, 2025TP-Link Multiple Routers Command Injection VulnerabilityCVE-2023-33538 · Network & remote access · TP-Link · reported by MITREExploitedHigh 8.8
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Jun 16, 2025 (federal fix deadline Jul 7, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com web.archive.org
Jun 2, 2025ASUS RT-AX55 Routers OS Command Injection VulnerabilityCVE-2023-39780 · Network & remote access · ASUS · reported by MITREExploitedHigh 8.8
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.
Product
RT-AX55 Routers
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ASUS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 19, 2025Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityCVE-2025-4428 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
May 19, 2025Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass VulnerabilityCVE-2025-4427 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedMedium 5.3
Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
May 15, 2025DrayTek Vigor Routers OS Command Injection VulnerabilityCVE-2024-12987 · Network & remote access · DrayTek · reported by VulDBExploitedMedium 6.9
DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
Product
Vigor Routers
On CISA’s list since
May 15, 2025 (federal fix deadline Jun 5, 2025)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog netsecfish.notion.site vuldb.com
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-11120 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-6047 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 2, 2025Commvault Command Center Path Traversal VulnerabilityCVE-2025-34028 · Other software · Commvault · reported by VulnCheckExploitedCritical 9.3
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Product
Command Center
On CISA’s list since
May 2, 2025 (federal fix deadline May 23, 2025)
What to do
Attackers are using this now. Install Commvault’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.commvault.com github.com
May 1, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2023-44221 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.2
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Product
SMA100 Appliances
On CISA’s list since
May 1, 2025 (federal fix deadline May 22, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 16, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2021-20035 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedMedium 6.5
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Product
SMA100 Appliances
On CISA’s list since
Apr 16, 2025 (federal fix deadline May 7, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Mar 19, 2025Edimax IC-7100 IP Camera OS Command Injection VulnerabilityCVE-2025-1316 · Other software · Edimax · reported by ics-cert@hq.dhs.govExploitedCritical 9.3
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
IC-7100 IP Camera
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install Edimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cisa.gov cisa.gov
Mar 11, 2025Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCVE-2025-26633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13161 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13160 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13159 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 3, 2025Cisco Small Business RV Series Routers Command Injection VulnerabilityCVE-2023-20118 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
Product
Small Business RV Series Routers
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 24, 2025Oracle Agile Product Lifecycle Management (PLM) Deserialization VulnerabilityCVE-2024-20953 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 8.8
Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Feb 24, 2025 (federal fix deadline Mar 17, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40891 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40890 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 4, 2025Paessler PRTG Network Monitor OS Command Injection VulnerabilityCVE-2018-9276 · Other software · Paessler · reported by MITREExploitedHigh 7.2
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Product
Controllers
On CISA’s list since
Jan 16, 2025 (federal fix deadline Feb 6, 2025)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.aviatrix.com docs.aviatrix.com
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 18, 2024Reolink RLC-410W IP Camera OS Command Injection Vulnerability CVE-2021-40407 · Other software · Reolink · reported by talos-cna@cisco.comExploitedHigh 7.2
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
Product
RLC-410W IP Camera
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog talosintelligence.com talosintelligence.com
Dec 18, 2024Reolink Multiple IP Cameras OS Command Injection VulnerabilityCVE-2019-11001 · Other software · Reolink · reported by MITREExploitedHigh 7.2
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
Product
Multiple IP Cameras
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com vdoo.com
Dec 18, 2024NUUO NVRmini Devices OS Command Injection Vulnerability CVE-2018-14933 · Other software · NUUO · reported by MITREExploitedCritical 9.8
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
Product
NVRmini Devices
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install NUUO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exploit-db.com exploit-db.com
Nov 21, 2024Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityCVE-2024-21287 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityCVE-2024-9474 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareMedium 6.9
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityCVE-2024-0012 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 9.3
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Nov 18, 2024Progress Kemp LoadMaster OS Command Injection VulnerabilityCVE-2024-1212 · Other software · Progress · reported by security@progress.comExploitedCritical 10
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Product
Kemp LoadMaster
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog freeloadbalancer.com kemptechnologies.com
Nov 14, 2024Palo Alto Networks Expedition OS Command Injection VulnerabilityCVE-2024-9463 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.9
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Product
Expedition
On CISA’s list since
Nov 14, 2024 (federal fix deadline Dec 5, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Nov 4, 2024PTZOptics PT30X-SDI/NDI Cameras OS Command Injection VulnerabilityCVE-2024-8957 · Other software · PTZOptics · reported by VulnCheckExploitedHigh 7.2
PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script.
Product
PT30X-SDI/NDI Cameras
On CISA’s list since
Nov 4, 2024 (federal fix deadline Nov 25, 2024)
What to do
Attackers are using this now. Install PTZOptics’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptzoptics.com vulncheck.com
Oct 23, 2024Fortinet FortiManager Missing Authentication VulnerabilityCVE-2024-47575 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
FortiManager
On CISA’s list since
Oct 23, 2024 (federal fix deadline Nov 13, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Oct 9, 2024Ivanti Cloud Services Appliance (CSA) OS Command Injection VulnerabilityCVE-2024-9380 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 3, 2024Synacor Zimbra Collaboration Suite (ZCS) Command Execution VulnerabilityCVE-2024-45519 · Email & office · Synacor · reported by MITREExploitedCritical 10
Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 3, 2024 (federal fix deadline Oct 24, 2024)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Oct 2, 2024Ivanti Endpoint Manager (EPM) SQL Injection VulnerabilityCVE-2024-29824 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 8.8
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
Product
Endpoint Manager (EPM)
On CISA’s list since
Oct 2, 2024 (federal fix deadline Oct 23, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Sep 30, 2024DrayTek Multiple Vigor Routers OS Command Injection VulnerabilityCVE-2020-15415 · Network & remote access · DrayTek · reported by MITREExploitedCritical 9.8
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
Product
Multiple Vigor Routers
On CISA’s list since
Sep 30, 2024 (federal fix deadline Oct 21, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com draytek.com
Sep 30, 2024D-Link DIR-820 Router OS Command Injection VulnerabilityCVE-2023-25280 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Product
DIR-820 Router
On CISA’s list since
Sep 30, 2024 (federal fix deadline Oct 21, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com dlink.com
Sep 24, 2024Ivanti Virtual Traffic Manager Authentication Bypass VulnerabilityCVE-2024-7593 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
Product
Virtual Traffic Manager
On CISA’s list since
Sep 24, 2024 (federal fix deadline Oct 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.