Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

109 results · page 2 of 3

Aug 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-38213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jun 13, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Product
Telerik Report Server
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.telerik.com docs.telerik.com
Jun 13, 2024Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityCVE-2024-26169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 20, 2024NextGen Healthcare Mirth Connect Deserialization of Untrusted Data VulnerabilityCVE-2023-43208 · Other software · NextGen Healthcare · reported by MITREExploitedRansomwareCritical 9.8
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
Product
Mirth Connect
On CISA’s list since
May 20, 2024 (federal fix deadline Jun 10, 2024)
What to do
Attackers are using this now. Install NextGen Healthcare’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com horizon3.ai
Apr 30, 2024Microsoft SmartScreen Prompt Security Feature Bypass VulnerabilityCVE-2024-29988 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.
Product
SmartScreen Prompt
On CISA’s list since
Apr 30, 2024 (federal fix deadline May 21, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 25, 2024Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2023-48788 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
Product
FortiClient EMS
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Feb 13, 2024Microsoft Windows Internet Shortcut Files Security Feature Bypass VulnerabilityCVE-2024-21412 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.1
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
Product
Windows
On CISA’s list since
Feb 13, 2024 (federal fix deadline Mar 5, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-21351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.6
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
Product
Windows
On CISA’s list since
Feb 13, 2024 (federal fix deadline Mar 5, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 9, 2024Fortinet FortiOS Out-of-Bound Write VulnerabilityCVE-2024-21762 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
Product
FortiOS
On CISA’s list since
Feb 9, 2024 (federal fix deadline Feb 16, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jan 2, 2024Google Chromium WebRTC Heap Buffer Overflow VulnerabilityCVE-2023-7024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
Product
Chromium WebRTC
On CISA’s list since
Jan 2, 2024 (federal fix deadline Jan 23, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 14, 2023Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-36025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.
Product
Windows
On CISA’s list since
Nov 14, 2023 (federal fix deadline Dec 5, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 10, 2023Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write VulnerabilityCVE-2023-20109 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.6
Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.
Product
IOS and IOS XE
On CISA’s list since
Oct 10, 2023 (federal fix deadline Oct 31, 2023)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 25, 2023Apple Multiple Products Improper Certificate Validation VulnerabilityCVE-2023-41991 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jul 11, 2023Microsoft Windows Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2023-32049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 11, 2023Microsoft Windows Error Reporting Service Privilege Escalation VulnerabilityCVE-2023-36874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Jun 13, 2023Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityCVE-2023-27997 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Product
FortiOS and FortiProxy SSL-VPN
On CISA’s list since
Jun 13, 2023 (federal fix deadline Jul 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
May 19, 2023Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilityCVE-2023-21492 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.
Product
Mobile Devices
On CISA’s list since
May 19, 2023 (federal fix deadline Jun 9, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Apr 7, 2023Microsoft Windows Certificate Dialog Privilege Escalation VulnerabilityCVE-2019-1388 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.
Product
Windows
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com zerodayinitiative.com
Mar 30, 2023Fortra Cobalt Strike User Interface Remote Code Execution VulnerabilityCVE-2022-42948 · Other software · Fortra · reported by MITREExploitedCritical 9.8
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
Product
Cobalt Strike
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog thesecmaster.com cobaltstrike.com
Mar 30, 2023Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) VulnerabilityCVE-2022-39197 · Other software · Fortra · reported by MITREExploitedMedium 6.1
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Product
Cobalt Strike
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cobaltstrike.com cobaltstrike.com
Mar 14, 2023Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-24880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 4.4
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Product
Windows
On CISA’s list since
Mar 14, 2023 (federal fix deadline Apr 4, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 14, 2023Fortinet FortiOS Path Traversal VulnerabilityCVE-2022-41328 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 6.7
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
Product
FortiOS
On CISA’s list since
Mar 14, 2023 (federal fix deadline Apr 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Feb 10, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · Fortra · reported by cve@rapid7.comExploitedRansomwareHigh 7.2
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Product
GoAnywhere MFT
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Dec 29, 2022TIBCO JasperReports Server Information Disclosure VulnerabilityCVE-2018-5430 · Other software · TIBCO · reported by security@tibco.comExploitedHigh 8.8
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Product
JasperReports
On CISA’s list since
Dec 29, 2022 (federal fix deadline Jan 19, 2023)
What to do
Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhinosecuritylabs.com exploit-db.com
Dec 29, 2022TIBCO JasperReports Library Directory Traversal VulnerabilityCVE-2018-18809 · Other software · TIBCO · reported by security@tibco.comExploitedMedium 6.5
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Product
JasperReports
On CISA’s list since
Dec 29, 2022 (federal fix deadline Jan 19, 2023)
What to do
Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Dec 13, 2022Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVE-2022-42475 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Product
FortiOS
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 13, 2022Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2022-44698 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.4
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Product
Defender
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 11, 2022Fortinet Multiple Products Authentication Bypass VulnerabilityCVE-2022-40684 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Product
Multiple Products
On CISA’s list since
Oct 11, 2022 (federal fix deadline Nov 1, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 8, 2022Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityCVE-2018-13374 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 4.3
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Product
FortiOS and FortiADC
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Sep 8, 2022D-Link DIR-300 Router Cleartext Storage of a Password VulnerabilityCVE-2011-4723 · Network & remote access · D-Link · reported by MITREExploitedMedium 5.7
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
Product
DIR-300 Router
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog en.securitylab.ru en.securitylab.ru
Aug 25, 2022WebRTC Heap Buffer Overflow VulnerabilityCVE-2022-2294 · Other software · WebRTC · reported by chrome-cve-admin@google.comExploitedRansomwareHigh 8.8
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
Product
WebRTC
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install WebRTC’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com chromereleases.googleblog.com
Aug 9, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-34713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
Product
Windows
On CISA’s list since
Aug 9, 2022 (federal fix deadline Aug 30, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 14, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-30190 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Product
Windows
On CISA’s list since
Jun 14, 2022 (federal fix deadline Jul 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
May 24, 2022Artifex Ghostscript Type Confusion VulnerabilityCVE-2017-8291 · Other software · Artifex · reported by MITREExploitedHigh 7.8
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Product
Ghostscript
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Artifex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com debian.org
May 24, 2022Kaseya VSA SQL Injection VulnerabilityCVE-2017-18362 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 9.8
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
Product
Virtual System/Server Administrator (VSA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archive.today github.com
May 23, 2022Cisco IOS XR Open Port VulnerabilityCVE-2022-20821 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Product
IOS XR
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Apr 13, 2022Kaseya VSA Remote Code Execution VulnerabilityCVE-2018-20753 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 9.8
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
Product
Virtual System/Server Administrator (VSA)
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.huntresslabs.com helpdesk.kaseya.com
Mar 25, 2022Citrix Multiple Products Remote Code Execution VulnerabilityCVE-2017-6316 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Product
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022VMware Tanzu Spring Data Commons Property Binder VulnerabilityCVE-2018-1273 · Other software · VMware Tanzu · reported by security_alert@emc.comExploitedRansomwareCritical 9.8
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
Product
Spring Data Commons
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install VMware Tanzu’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mail-archives.apache.org pivotal.io
Mar 15, 2022Microsoft Windows Error Reporting Manager Privilege Escalation VulnerabilityCVE-2019-1315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service VulnerabilityCVE-2018-0156 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service VulnerabilityCVE-2017-12319 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.9
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
Product
IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com tools.cisco.com
Mar 3, 2022Oracle VirtualBox Insufficient Input Validation VulnerabilityCVE-2008-3431 · Other software · Oracle · reported by MITREExploitedHigh 8.8
An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
Product
VirtualBox
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securityreason.com
Jan 10, 2022Fortinet FortiOS and FortiProxy Improper AuthorizationCVE-2018-13382 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.1
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jan 10, 2022Fortinet FortiOS and FortiProxy Out-of-bounds WriteCVE-2018-13383 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 4.3
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 10, 2021Apache Solr DataImportHandler Code Injection VulnerabilityCVE-2019-0193 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.2
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Product
Solr
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Dec 10, 2021Fortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedLow 3.3
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Product
FortiOS
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 1, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Product
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com pitstop.manageengine.com
Nov 3, 2021Cisco HyperFlex HX Installer Virtual Machine Command Injection VulnerabilityCVE-2021-1497 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.
Product
HyperFlex HX
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Cisco IOS and IOS XE Software Smart Install Remote Code Execution VulnerabilityCVE-2018-0171 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
Product
IOS and IOS XE
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.