Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

152 results · page 2 of 4

Jun 23, 2023Apple Multiple Products WebKit Memory Corruption VulnerabilityCVE-2023-32435 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 23, 2023Apple Multiple Products Integer Overflow VulnerabilityCVE-2023-32434 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org support.apple.com
Jun 23, 2023Apple Multiple Products WebKit Sandbox Escape VulnerabilityCVE-2023-32409 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.6
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 23, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-32373 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
Jun 23, 2023Apple Multiple Products WebKit Out-of-Bounds Read VulnerabilityCVE-2023-28204 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.5
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
May 15, 2023In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resultCVE-2023-1698 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
Product
Compact Controller CC100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Apr 10, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-28205 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Apr 10, 2023 (federal fix deadline May 1, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 23, 2023In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resCVE-2022-4224 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
Product
Control RTE (SL)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
Feb 27, 2023Apple Multiple Products WebKit Type Confusion VulnerabilityCVE-2023-23529 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 13, 2023Multiple Ruckus Wireless Products CSRF and RCE VulnerabilityCVE-2023-25717 · Other software · Ruckus Wireless · reported by MITREExploitedCritical 9.8
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
Product
Multiple Products
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Ruckus Wireless’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cybir.com support.ruckuswireless.com
Jan 18, 2023Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-47966 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Product
ManageEngine
On CISA’s list since
Jan 23, 2023 (federal fix deadline Feb 13, 2023)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 11, 2023Multiple SugarCRM Products Remote Code Execution VulnerabilityCVE-2023-22952 · Other software · SugarCRM · reported by MITREExploitedHigh 8.8
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Product
Multiple Products
On CISA’s list since
Feb 2, 2023 (federal fix deadline Feb 23, 2023)
What to do
Attackers are using this now. Install SugarCRM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.sugarcrm.com
Dec 1, 2022In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidenCVE-2022-3270 · Other software · Festo SE · reported by info@cert.vde.comCritical 9.8
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.
Product
Bus module CPX-E-EP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 9, 2022In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memCVE-2021-34569 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.
Product
750-81xx/xxx-xxxFW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 9, 2022In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denialCVE-2021-34568 · Other software · WAGO · reported by info@cert.vde.comHigh 7.5
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service.
Product
750-81xx/xxx-xxxFW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 9, 2022In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denialCVE-2021-34567 · Other software · WAGO · reported by info@cert.vde.comHigh 8.2
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read.
Product
750-81xx/xxx-xxxFW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 9, 2022In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iochecCVE-2021-34566 · Other software · WAGO · reported by info@cert.vde.comCritical 9.1
In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.
Product
750-81xx/xxx-xxxFW
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Oct 18, 2022Fortinet Multiple Products Authentication Bypass VulnerabilityCVE-2022-40684 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Product
Multiple Products
On CISA’s list since
Oct 11, 2022 (federal fix deadline Nov 1, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 16, 2022An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in IchitaroCVE-2022-36344 · Other software · JustSystems Corporation · reported by vultures@jpcert.or.jpCritical 9.8
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
Product
JustSystems JUST Online Update for J-License'
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp justsystems.com
Jul 19, 2022Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-35405 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Product
ManageEngine
On CISA’s list since
Sep 22, 2022 (federal fix deadline Oct 13, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com manageengine.com
Jun 24, 2022Multiple products of CODESYS implement a improper error handling.CVE-2022-1965 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.1
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.
Product
Runtime Toolkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
Apr 18, 2022WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityCVE-2022-29464 · Other software · WSO2 · reported by MITREExploitedRansomwareCritical 9.8
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
Product
Multiple Products
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install WSO2’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Apr 13, 2022VMware Multiple Products Privilege Escalation VulnerabilityCVE-2022-22960 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
Product
Multiple Products
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 9, 2022SAP Multiple Products HTTP Request Smuggling VulnerabilityCVE-2022-22536 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 10
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
Product
Multiple Products
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog launchpad.support.sap.com sap.com
Oct 19, 2021Apple Multiple Products Memory Corruption VulnerabilityCVE-2021-30807 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 8, 2021Apple Multiple Products WebKit Memory Corruption VulnerabilityCVE-2021-30665 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 8, 2021Apple Multiple Products WebKit Integer Overflow VulnerabilityCVE-2021-30663 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 8, 2021Apple Multiple Products WebKit Storage Use-After-Free VulnerabilityCVE-2021-30661 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 24, 2021Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCVE-2021-30952 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com lists.fedoraproject.org
Aug 24, 2021Apple Multiple Products Memory Corruption VulnerabilityCVE-2021-30883 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
Product
Multiple Products
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Aug 24, 2021Apple Multiple Products Integer Overflow VulnerabilityCVE-2021-30860 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Jul 29, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36742 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Jul 29, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36741 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Apr 2, 2021Apple Multiple Products Type Confusion VulnerabilityCVE-2021-1789 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Apr 2, 2021Apple Multiple Products Race Condition VulnerabilityCVE-2021-1782 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7
Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 3, 2021Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityCVE-2021-22681 · Other software · Rockwell · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Rockwell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.cisa.gov us-cert.cisa.gov
Dec 22, 2020Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityCVE-2020-29583 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp.zyxel.com businessforum.zyxel.com
Dec 8, 2020Apple Multiple Products Memory Initialization VulnerabilityCVE-2020-27950 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Dec 8, 2020Apple Multiple Products Type Confusion VulnerabilityCVE-2020-27932 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Dec 8, 2020Apple Multiple Products Memory Corruption VulnerabilityCVE-2020-27930 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 23, 2020Multiple VMware Products Command Injection VulnerabilityCVE-2020-4006 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.1
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com kb.cert.org
Oct 16, 2020Apple Multiple Products Memory Corruption VulnerabilityCVE-2020-9907 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 1, 2020Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Jul 24, 2020In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display.CVE-2020-10614 · Other software · Osisoft · reported by ics-cert@hq.dhs.govMedium 4.8
In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modification is possible if a victim views the infected display.
Product
PI Vision
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 24, 2020In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requestCVE-2020-10604 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.5
In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive.
Product
PI Data Archive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 24, 2020In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to CVE-2020-10610 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.8
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.
Product
PI API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 24, 2020In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries.CVE-2020-10608 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.8
In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.
Product
PI API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 24, 2020In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software.CVE-2020-10606 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.8
In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment.
Product
PI API
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 24, 2020In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition.CVE-2020-10602 · Other software · PI · reported by ics-cert@hq.dhs.govMedium 5.3
In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive.
Product
Data Archive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jul 6, 2020Ivanti MobileIron Multiple Products Remote Code Execution VulnerabilityCVE-2020-15505 · Network & remote access · Ivanti · reported by MITREExploitedCritical 9.8
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
Product
MobileIron Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.