Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

141 results · page 2 of 3

Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 14, 2025SKYSEA Client View Improper Authentication VulnerabilityCVE-2016-7836 · Other software · SKYSEA · reported by vultures@jpcert.or.jpExploitedCritical 9.8
SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
Product
Client View
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install SKYSEA’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com skyseaclientview.net
Oct 2, 2025Juniper ScreenOS Improper Authentication VulnerabilityCVE-2015-7755 · Network & remote access · Juniper · reported by MITREExploitedCritical 9.8
Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
Product
ScreenOS
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com kb.juniper.net
Sep 25, 2025Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityCVE-2025-20362 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
Product
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
On CISA’s list since
Sep 25, 2025 (federal fix deadline Sep 26, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 3, 2025TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityCVE-2023-50224 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comExploitedMedium 6.5
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
TL-WR841N
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Sep 2, 2025TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityCVE-2020-24363 · Network & remote access · TP-Link · reported by MITREExploitedHigh 8.8
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
TL-WA855RE
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog malwrforensics.com pastebin.com
Sep 2, 2025Meta Platforms WhatsApp Incorrect Authorization VulnerabilityCVE-2025-55177 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedMedium 5.4
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Product
WhatsApp
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog facebook.com whatsapp.com
Aug 29, 2025Sangoma FreePBX Authentication Bypass VulnerabilityCVE-2025-57819 · Other software · Sangoma · reported by GitHubExploitedCritical 10
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Product
FreePBX
On CISA’s list since
Aug 29, 2025 (federal fix deadline Sep 19, 2025)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.freepbx.org github.com
Jul 22, 2025Microsoft SharePoint Improper Authentication VulnerabilityCVE-2025-49706 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Product
SharePoint
On CISA’s list since
Jul 22, 2025 (federal fix deadline Jul 23, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Jun 25, 2025AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityCVE-2024-54085 · Other software · AMI · reported by biossecurity@ami.comExploitedCritical 10
AMI MegaRAC SPx contains an authentication bypass by spoofing vulnerability in the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
Product
MegaRAC SPx
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install AMI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog go.ami.com arstechnica.com
Jun 9, 2025Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityCVE-2025-32433 · Other software · Erlang · reported by GitHubExploitedCritical 10
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
Product
Erlang/OTP
On CISA’s list since
Jun 9, 2025 (federal fix deadline Jun 30, 2025)
What to do
Attackers are using this now. Install Erlang’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21479 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21480 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 2, 2025ASUS Routers Improper Authentication VulnerabilityCVE-2021-32030 · Network & remote access · ASUS · reported by MITREExploitedCritical 9.8
ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Routers
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ASUS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com asus.com
Jun 2, 2025ConnectWise ScreenConnect Improper Authentication VulnerabilityCVE-2025-3935 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedHigh 8.1
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
Product
ScreenConnect
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog connectwise.com connectwise.com
May 19, 2025Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass VulnerabilityCVE-2025-4427 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedMedium 5.3
Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
May 5, 2025Langflow Missing Authentication VulnerabilityCVE-2025-3248 · Other software · Langflow · reported by VulnCheckExploitedRansomwareCritical 9.8
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Product
Langflow
On CISA’s list since
May 5, 2025 (federal fix deadline May 26, 2025)
What to do
Attackers are using this now. Install Langflow’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 7, 2025CrushFTP Authentication Bypass VulnerabilityCVE-2025-31161 · Other software · CrushFTP · reported by MITREExploitedRansomwareCritical 9.8
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
Product
CrushFTP
On CISA’s list since
Apr 7, 2025 (federal fix deadline Apr 28, 2025)
What to do
Attackers are using this now. Install CrushFTP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog crushftp.com outpost24.com
Mar 18, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2025-24472 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareHigh 8.1
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Product
FortiOS and FortiProxy
On CISA’s list since
Mar 18, 2025 (federal fix deadline Apr 8, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Mar 3, 2025Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityCVE-2022-43939 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.6
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Feb 18, 2025Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2025-0108 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.8
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Product
PAN-OS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com github.com
Feb 18, 2025SonicWall SonicOS SSLVPN Improper Authentication VulnerabilityCVE-2024-53704 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
Product
SonicOS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Feb 12, 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityCVE-2025-24200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.1
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Product
iOS and iPadOS
On CISA’s list since
Feb 12, 2025 (federal fix deadline Mar 5, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jan 14, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2024-55591 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 14, 2025 (federal fix deadline Jan 21, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Dec 18, 2024NUUO NVRmini2 Devices Missing Authentication Vulnerability CVE-2022-23227 · Other software · NUUO · reported by MITREExploitedCritical 9.8
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Product
NVRmini2 Devices
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install NUUO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Dec 17, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Product
Multiple Products
On CISA’s list since
Dec 17, 2024 (federal fix deadline Jan 7, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com support.cleo.com
Dec 3, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSend · reported by VulnCheckExploitedCritical 9.8
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Product
ProjectSend
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Nov 25, 2024Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityCVE-2023-28461 · Network & remote access · Array Networks · reported by MITREExploitedRansomwareCritical 9.8
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
Product
AG/vxAG ArrayOS
On CISA’s list since
Nov 25, 2024 (federal fix deadline Dec 16, 2024)
What to do
Attackers are using this now. Install Array Networks ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.arraynetworks.net support.arraynetworks.net
Nov 21, 2024Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityCVE-2024-21287 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityCVE-2024-0012 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 9.3
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Nov 7, 2024Palo Alto Networks Expedition Missing Authentication VulnerabilityCVE-2024-5910 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.3
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
Product
Expedition
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Nov 4, 2024PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass VulnerabilityCVE-2024-8956 · Other software · PTZOptics · reported by VulnCheckExploitedCritical 9.1
PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root.
Product
PT30X-SDI/NDI Cameras
On CISA’s list since
Nov 4, 2024 (federal fix deadline Nov 25, 2024)
What to do
Attackers are using this now. Install PTZOptics’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptzoptics.com vulncheck.com
Oct 23, 2024Fortinet FortiManager Missing Authentication VulnerabilityCVE-2024-47575 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
FortiManager
On CISA’s list since
Oct 23, 2024 (federal fix deadline Nov 13, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Sep 24, 2024Ivanti Virtual Traffic Manager Authentication Bypass VulnerabilityCVE-2024-7593 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
Product
Virtual Traffic Manager
On CISA’s list since
Sep 24, 2024 (federal fix deadline Oct 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Aug 27, 2024Apache OFBiz Incorrect Authorization VulnerabilityCVE-2024-38856 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Product
OFBiz
On CISA’s list since
Aug 27, 2024 (federal fix deadline Sep 17, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33045 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33044 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Jul 30, 2024VMware ESXi Authentication Bypass VulnerabilityCVE-2024-37085 · Other software · VMware · reported by security@vmware.comExploitedRansomwareMedium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Product
ESXi
On CISA’s list since
Jul 30, 2024 (federal fix deadline Aug 20, 2024)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Jul 23, 2024Twilio Authy Information Disclosure VulnerabilityCVE-2024-39891 · Other software · Twilio · reported by MITREExploitedMedium 5.3
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Product
Authy
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Twilio’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org bleepingcomputer.com
Jun 13, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Product
Telerik Report Server
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.telerik.com docs.telerik.com
Mar 7, 2024JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2024-27198 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
Product
TeamCity
On CISA’s list since
Mar 7, 2024 (federal fix deadline Mar 28, 2024)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com
Feb 22, 2024ConnectWise ScreenConnect Authentication Bypass VulnerabilityCVE-2024-1709 · Other software · ConnectWise · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedRansomwareCritical 10
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
Product
ScreenConnect
On CISA’s list since
Feb 22, 2024 (federal fix deadline Feb 29, 2024)
What to do
Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jan 18, 2024Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass VulnerabilityCVE-2023-35082 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
Product
Endpoint Manager Mobile (EPMM) and MobileIron Core
On CISA’s list since
Jan 18, 2024 (federal fix deadline Feb 8, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jan 10, 2024Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityCVE-2023-46805 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareHigh 8.2
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
Product
Connect Secure and Policy Secure
On CISA’s list since
Jan 10, 2024 (federal fix deadline Jan 22, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.ivanti.com
Nov 13, 2023Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36846 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Nov 13, 2023Juniper Junos OS EX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36847 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Nov 13, 2023Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36851 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Nov 7, 2023Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityCVE-2023-22518 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
Product
Confluence Data Center and Server
On CISA’s list since
Nov 7, 2023 (federal fix deadline Nov 28, 2023)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com confluence.atlassian.com
Oct 31, 2023F5 BIG-IP Configuration Utility Authentication Bypass VulnerabilityCVE-2023-46747 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.
Product
BIG-IP Configuration Utility
On CISA’s list since
Oct 31, 2023 (federal fix deadline Nov 21, 2023)
What to do
Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com my.f5.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.