Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

572 results · page 2 of 12

Mar 30, 2026Citrix NetScaler Out-of-Bounds Read VulnerabilityCVE-2026-3055 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.3
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
Product
NetScaler
On CISA’s list since
Mar 30, 2026 (federal fix deadline Apr 2, 2026)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com labs.watchtowr.com
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.8
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com isc.sans.org
Feb 3, 2026Sangoma FreePBX OS Command Injection VulnerabilityCVE-2025-64328 · Other software · Sangoma · reported by GitHubExploitedHigh 8.6
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
Product
FreePBX
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 3, 2026 Sangoma FreePBX Improper Authentication VulnerabilityCVE-2019-19006 · Other software · Sangoma · reported by MITREExploitedCritical 9.8
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
Product
FreePBX
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.freepbx.org pastebin.com
Jan 26, 2026Linux Kernel Integer Overflow VulnerabilityCVE-2018-14634 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
Product
Kernel
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com securityfocus.com
Dec 19, 2025WatchGuard Firebox Out of Bounds Write VulnerabilityCVE-2025-14733 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3ExploitedRansomwareCritical 9.3
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
Product
Firebox
On CISA’s list since
Dec 19, 2025 (federal fix deadline Dec 26, 2025)
What to do
Attackers are using this now. Install WatchGuard’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.watchguard.com watchguard.com
Dec 15, 2025Gladinet CentreStack and Triofox Hard Coded Cryptographic VulnerabilityCVE-2025-14611 · Other software · Gladinet · reported by 5dacb0b8-2277-4717-899c-254586fe4912ExploitedHigh 7.1
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
Product
CentreStack and Triofox
On CISA’s list since
Dec 15, 2025 (federal fix deadline Jan 5, 2026)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huntress.com cisa.gov
Dec 11, 2025OSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-58360 · Other software · OSGeo · reported by GitHubExploitedHigh 8.2
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
Product
GeoServer
On CISA’s list since
Dec 11, 2025 (federal fix deadline Jan 1, 2026)
What to do
Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com osgeo-org.atlassian.net
Dec 5, 2025Meta React Server Components Remote Code Execution VulnerabilityCVE-2025-55182 · Other software · Meta · reported by cve-assign@fb.comExploitedRansomwareCritical 10
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Product
React Server Components
On CISA’s list since
Dec 5, 2025 (federal fix deadline Dec 12, 2025)
What to do
Attackers are using this now. Install Meta’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog react.dev facebook.com
Nov 12, 2025Gladinet Triofox Improper Access Control VulnerabilityCVE-2025-12480 · Other software · Gladinet · reported by mandiant-cve@google.comExploitedCritical 9.1
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
Product
Triofox
On CISA’s list since
Nov 12, 2025 (federal fix deadline Dec 3, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog access.triofox.com cloud.google.com
Nov 12, 2025WatchGuard Firebox Out-of-Bounds Write VulnerabilityCVE-2025-9242 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3ExploitedCritical 9.3
WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
Product
Firebox
On CISA’s list since
Nov 12, 2025 (federal fix deadline Dec 3, 2025)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.watchguard.com watchguard.com
Nov 4, 2025Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityCVE-2025-11371 · Other software · Gladinet · reported by 5dacb0b8-2277-4717-899c-254586fe4912ExploitedHigh 7.5
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
Product
CentreStack and Triofox
On CISA’s list since
Nov 4, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huntress.com centrestack.com
Oct 30, 2025XWiki Platform Eval Injection VulnerabilityCVE-2025-24893 · Other software · XWiki · reported by GitHubExploitedCritical 9.8
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
Product
Platform
On CISA’s list since
Oct 30, 2025 (federal fix deadline Nov 20, 2025)
What to do
Attackers are using this now. Install XWiki’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 22, 2025Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel VulnerabilityCVE-2025-61932 · Other software · Motex · reported by vultures@jpcert.or.jpExploitedCritical 9.3
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
Product
LANSCOPE Endpoint Manager
On CISA’s list since
Oct 22, 2025 (federal fix deadline Nov 12, 2025)
What to do
Attackers are using this now. Install Motex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp motex.co.jp
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2746 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 15, 2025Adobe Experience Manager Forms Code Execution VulnerabilityCVE-2025-54253 · Other software · Adobe · reported by AdobeExploitedCritical 10
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Product
Experience Manager (AEM) Forms
On CISA’s list since
Oct 15, 2025 (federal fix deadline Nov 5, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com slcyber.io
Oct 14, 2025IGEL OS Use of a Key Past its Expiration Date VulnerabilityCVE-2025-47827 · Other software · IGEL · reported by MITREExploitedMedium 4.6
IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
Product
IGEL OS
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install IGEL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 6, 2025Linux Kernel Heap Out-of-Bounds Write VulnerabilityCVE-2021-22555 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comExploitedHigh 8.3
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
Product
Kernel
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Oct 6, 2025Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityCVE-2010-3962 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
Oct 6, 2025Microsoft Windows Remote Code Execution VulnerabilityCVE-2011-3402 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.mcafee.com blogs.technet.com
Oct 6, 2025Mozilla Multiple Products Remote Code Execution VulnerabilityCVE-2010-3765 · Computers, phones & browsers · Mozilla · reported by MITREExploitedCritical 9.8
Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
Product
Multiple Products
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.mozilla.com blogs.sun.com
Oct 2, 2025Jenkins Remote Code Execution VulnerabilityCVE-2017-1000353 · Websites & servers · Jenkins · reported by MITREExploitedCritical 9.8
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
Product
Jenkins
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Sep 29, 2025Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution VulnerabilityCVE-2025-20352 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.7
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
Product
IOS and IOS XE
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 4, 2025Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityCVE-2025-38352 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Product
Kernel
On CISA’s list since
Sep 4, 2025 (federal fix deadline Sep 25, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Aug 29, 2025Sangoma FreePBX Authentication Bypass VulnerabilityCVE-2025-57819 · Other software · Sangoma · reported by GitHubExploitedCritical 10
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Product
FreePBX
On CISA’s list since
Aug 29, 2025 (federal fix deadline Sep 19, 2025)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.freepbx.org github.com
Aug 26, 2025Citrix NetScaler Memory Overflow VulnerabilityCVE-2025-7775 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.2
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Product
NetScaler
On CISA’s list since
Aug 26, 2025 (federal fix deadline Aug 28, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 25, 2025Citrix Session Recording Deserialization of Untrusted Data VulnerabilityCVE-2024-8069 · Network & remote access · Citrix · reported by secure@citrix.comExploitedMedium 5.1
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Product
Session Recording
On CISA’s list since
Aug 25, 2025 (federal fix deadline Sep 15, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 25, 2025Citrix Session Recording Improper Privilege Management VulnerabilityCVE-2024-8068 · Network & remote access · Citrix · reported by secure@citrix.comExploitedMedium 5.1
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Product
Session Recording
On CISA’s list since
Aug 25, 2025 (federal fix deadline Sep 15, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Aug 18, 2025Trend Micro Apex One OS Command Injection VulnerabilityCVE-2025-54948 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.4
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Product
Apex One
On CISA’s list since
Aug 18, 2025 (federal fix deadline Sep 8, 2025)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com cisa.gov
Aug 12, 2025Microsoft Office Excel Remote Code Execution VulnerabilityCVE-2007-0671 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Product
Office
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Aug 12, 2025Microsoft Internet Explorer Resource Management Errors VulnerabilityCVE-2013-3893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2775 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2776 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 10, 2025Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCVE-2025-5777 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.3
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jul 10, 2025 (federal fix deadline Jul 11, 2025)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com citrixbleed.com
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Jun 30, 2025Citrix NetScaler ADC and Gateway Buffer Overflow VulnerabilityCVE-2025-6543 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.2
Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jun 30, 2025 (federal fix deadline Jul 21, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Jun 25, 2025AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityCVE-2024-54085 · Other software · AMI · reported by biossecurity@ami.comExploitedCritical 10
AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Product
MegaRAC SPx
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install AMI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog go.ami.com arstechnica.com
Jun 17, 2025Linux Kernel Improper Ownership Management VulnerabilityCVE-2023-0386 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Product
Kernel
On CISA’s list since
Jun 17, 2025 (federal fix deadline Jul 8, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com git.kernel.org
Jun 10, 2025 Microsoft Windows External Control of File Name or Path VulnerabilityCVE-2025-33053 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
Product
Windows
On CISA’s list since
Jun 10, 2025 (federal fix deadline Jul 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com research.checkpoint.com
Jun 2, 2025Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityCVE-2025-35939 · Other software · Craft CMS · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
Product
Craft CMS
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 2, 2025ASUS RT-AX55 Routers OS Command Injection VulnerabilityCVE-2023-39780 · Network & remote access · ASUS · reported by MITREExploitedHigh 8.8
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.
Product
RT-AX55 Routers
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ASUS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 19, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2024-27443 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
May 19, 2025Srimax Output Messenger Directory Traversal VulnerabilityCVE-2025-27920 · Other software · Srimax · reported by MITREExploitedHigh 7.2
Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Product
Output Messenger
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Srimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog outputmessenger.com srimax.com
May 19, 2025MDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityCVE-2024-11182 · Other software · MDaemon · reported by security@eset.comExploitedMedium 5.3
MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.
Product
Email Server
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install MDaemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog files.mdaemon.com cisa.gov
Apr 9, 2025Linux Kernel Out-of-Bounds Read VulnerabilityCVE-2024-53150 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.1
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
Product
Kernel
On CISA’s list since
Apr 9, 2025 (federal fix deadline Apr 30, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Apr 9, 2025Linux Kernel Out-of-Bounds Access VulnerabilityCVE-2024-53197 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Product
Kernel
On CISA’s list since
Apr 9, 2025 (federal fix deadline Apr 30, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Apr 8, 2025Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityCVE-2025-30406 · Other software · Gladinet · reported by MITREExploitedCritical 9
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Product
CentreStack
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gladinetsupport.s3.us-east-1.amazonaws.com centrestack.com
Mar 27, 2025Google Chromium Mojo Sandbox Escape VulnerabilityCVE-2025-2783 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.3
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Mojo
On CISA’s list since
Mar 27, 2025 (federal fix deadline Apr 17, 2025)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.