Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

449new WordPress flaws this week

390,525entries in the database

157 results · page 2 of 4

Nov 20, 2024VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38812 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
Product
vCenter Server
On CISA’s list since
Nov 20, 2024 (federal fix deadline Dec 11, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Oct 24, 2024Cisco ASA and FTD Denial-of-Service VulnerabilityCVE-2024-20481 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.8
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Oct 24, 2024 (federal fix deadline Nov 14, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 9, 2024Linux Kernel PIE Stack Buffer Corruption Vulnerability CVE-2017-1000253 · Computers, phones & browsers · Linux · reported by MITREExploitedRansomwareHigh 7.8
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
Product
Kernel
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install Linux’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Aug 21, 2024Linux Kernel Heap-Based Buffer Overflow VulnerabilityCVE-2022-0185 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 8.4
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
Product
Kernel
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org github.com
Aug 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-38213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 17, 2024Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityCVE-2024-34102 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com vicarius.io
May 14, 2024Microsoft Windows MSHTML Platform Security Feature Bypass VulnerabilityCVE-2024-30040 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.
Product
Windows
On CISA’s list since
May 14, 2024 (federal fix deadline Jun 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 30, 2024Microsoft SmartScreen Prompt Security Feature Bypass VulnerabilityCVE-2024-29988 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.
Product
SmartScreen Prompt
On CISA’s list since
Apr 30, 2024 (federal fix deadline May 21, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 24, 2024Cisco ASA and FTD Privilege Escalation VulnerabilityCVE-2024-20359 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Apr 24, 2024 (federal fix deadline May 1, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 24, 2024Cisco ASA and FTD Denial of Service VulnerabilityCVE-2024-20353 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Apr 24, 2024 (federal fix deadline May 1, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 29, 2024Microsoft Streaming Service Untrusted Pointer Dereference VulnerabilityCVE-2023-29360 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.4
Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Streaming Service
On CISA’s list since
Feb 29, 2024 (federal fix deadline Mar 21, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 15, 2024Cisco ASA and FTD Information Disclosure VulnerabilityCVE-2020-3259 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareHigh 7.5
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Feb 15, 2024 (federal fix deadline Mar 7, 2024)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Feb 13, 2024Microsoft Windows Internet Shortcut Files Security Feature Bypass VulnerabilityCVE-2024-21412 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.1
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
Product
Windows
On CISA’s list since
Feb 13, 2024 (federal fix deadline Mar 5, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-21351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.6
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
Product
Windows
On CISA’s list since
Feb 13, 2024 (federal fix deadline Mar 5, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jan 17, 2024Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-6549 · Network & remote access · Citrix · reported by secure@citrix.comExploitedHigh 8.2
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Jan 17, 2024 (federal fix deadline Feb 7, 2024)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Jan 2, 2024Google Chromium WebRTC Heap Buffer Overflow VulnerabilityCVE-2023-7024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
Product
Chromium WebRTC
On CISA’s list since
Jan 2, 2024 (federal fix deadline Jan 23, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 21, 2023GNU C Library Buffer Overflow VulnerabilityCVE-2023-4911 · Other software · GNU · reported by Red HatExploitedHigh 7.8
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Product
GNU C Library
On CISA’s list since
Nov 21, 2023 (federal fix deadline Dec 12, 2023)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog access.redhat.com access.redhat.com
Nov 16, 2023Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2023-36584 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Product
Windows
On CISA’s list since
Nov 16, 2023 (federal fix deadline Dec 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 14, 2023Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-36025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.
Product
Windows
On CISA’s list since
Nov 14, 2023 (federal fix deadline Dec 5, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 18, 2023Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-4966 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.4
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Oct 18, 2023 (federal fix deadline Nov 8, 2023)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Oct 2, 2023Google Chromium libvpx Heap Buffer Overflow VulnerabilityCVE-2023-5217 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Product
Chromium libvpx
On CISA’s list since
Oct 2, 2023 (federal fix deadline Oct 23, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 19, 2023MinIO Security Feature Bypass VulnerabilityCVE-2023-28434 · Other software · MinIO · reported by GitHubExploitedHigh 8.8
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.
Product
MinIO
On CISA’s list since
Sep 19, 2023 (federal fix deadline Oct 10, 2023)
What to do
Attackers are using this now. Install MinIO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 13, 2023Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access VulnerabilityCVE-2023-20269 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 5
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
Product
Adaptive Security Appliance and Firepower Threat Defense
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 13, 2023Google Chromium WebP Heap-Based Buffer Overflow VulnerabilityCVE-2023-4863 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Product
Chromium WebP
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Sep 11, 2023Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow VulnerabilityCVE-2023-41064 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 11, 2023 (federal fix deadline Oct 2, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com support.apple.com
Jul 11, 2023Microsoft Windows Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2023-32049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 11, 2023Microsoft Outlook Security Feature Bypass VulnerabilityCVE-2023-35311 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.
Product
Outlook
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 13, 2023Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityCVE-2023-27997 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Product
FortiOS and FortiProxy SSL-VPN
On CISA’s list since
Jun 13, 2023 (federal fix deadline Jul 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jun 5, 2023Zyxel Multiple Firewalls Buffer Overflow VulnerabilityCVE-2023-33009 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
Product
Multiple Firewalls
On CISA’s list since
Jun 5, 2023 (federal fix deadline Jun 26, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
Jun 5, 2023Zyxel Multiple Firewalls Buffer Overflow VulnerabilityCVE-2023-33010 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
Product
Multiple Firewalls
On CISA’s list since
Jun 5, 2023 (federal fix deadline Jun 26, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
Jun 2, 2023Progress MOVEit Transfer SQL Injection VulnerabilityCVE-2023-34362 · Other software · Progress · reported by MITREExploitedRansomwareCritical 9.8
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
Product
MOVEit Transfer
On CISA’s list since
Jun 2, 2023 (federal fix deadline Jun 23, 2023)
What to do
Attackers are using this now. Install Progress’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 14, 2023Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-24880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 4.4
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Product
Windows
On CISA’s list since
Mar 14, 2023 (federal fix deadline Apr 4, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 14, 2023Microsoft Office Publisher Security Feature Bypass VulnerabilityCVE-2023-21715 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Product
Office
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jan 26, 2023Telerik UI for ASP.NET AJAX Insecure Direct Object Reference VulnerabilityCVE-2017-11357 · Other software · Telerik · reported by MITREExploitedRansomwareCritical 9.8
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Product
User Interface (UI) for ASP.NET AJAX
On CISA’s list since
Jan 26, 2023 (federal fix deadline Feb 16, 2023)
What to do
Attackers are using this now. Install Telerik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog telerik.com exploit-db.com
Dec 13, 2022Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVE-2022-42475 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Product
FortiOS
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 13, 2022Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2022-44698 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.4
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Product
Defender
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 28, 2022Google Chromium GPU Heap Buffer Overflow VulnerabilityCVE-2022-4135 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium GPU
On CISA’s list since
Nov 28, 2022 (federal fix deadline Dec 19, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 14, 2022Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2022-41049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Product
Windows
On CISA’s list since
Nov 14, 2022 (federal fix deadline Dec 9, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 8, 2022Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2022-41091 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Product
Windows
On CISA’s list since
Nov 8, 2022 (federal fix deadline Dec 9, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Sep 15, 2022Code Aurora ACDB Audio Driver Stack-based Buffer Overflow VulnerabilityCVE-2013-2597 · Other software · Code Aurora · reported by MITREExploitedHigh 8.4
The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.
Product
ACDB Audio Driver
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Code Aurora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog codeaurora.org codeaurora.org
Sep 8, 2022QNAP Photo Station Externally Controlled Reference VulnerabilityCVE-2022-27593 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
Product
Photo Station
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Sep 8, 2022MikroTik RouterOS Stack-Based Buffer Overflow VulnerabilityCVE-2018-7445 · Network & remote access · MikroTik · reported by MITREExploitedCritical 9.8
In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
Product
RouterOS
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org securityfocus.com
Aug 25, 2022WebRTC Heap Buffer Overflow VulnerabilityCVE-2022-2294 · Other software · WebRTC · reported by chrome-cve-admin@google.comExploitedRansomwareHigh 8.8
WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
Product
WebRTC
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install WebRTC’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com chromereleases.googleblog.com
Jun 27, 2022Apple iOS and iPadOS Buffer Overflow VulnerabilityCVE-2021-30983 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 8, 2022NETGEAR Multiple Devices Buffer Overflow VulnerabilityCVE-2017-6862 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5ExploitedCritical 9.8
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
Product
Multiple Devices
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com kb.netgear.com
Jun 8, 2022Microsoft Office Buffer Overflow VulnerabilityCVE-2013-1331 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.
Product
Office
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Jun 8, 2022Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityCVE-2010-2883 · Email & office · Adobe · reported by AdobeExploitedHigh 7.3
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.metasploit.com community.websense.com
Jun 8, 2022Microsoft PowerPoint Buffer Overflow VulnerabilityCVE-2010-2572 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.
Product
PowerPoint
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Jun 8, 2022Microsoft Office Buffer Overflow VulnerabilityCVE-2009-0563 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.
Product
Office
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org securityfocus.com
Jun 8, 2022Adobe Acrobat and Reader Buffer Overflow VulnerabilityCVE-2007-5659 · Email & office · Adobe · reported by MITREExploitedHigh 7.8
Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.idefense.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.