Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,763 results · page 22 of 36

May 25, 2022Microsoft IME Japanese Privilege Escalation VulnerabilityCVE-2014-4077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
Product
Input Method Editor (IME) Japanese
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com securitytracker.com
May 25, 2022Linux Kernel Privilege Escalation VulnerabilityCVE-2014-3153 · Computers, phones & browsers · Linux · reported by chrome-cve-admin@google.comExploitedHigh 7.8
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
Product
Kernel
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org linux.oracle.com
May 25, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2013-7331 · Computers, phones & browsers · Microsoft · reported by MITREExploitedMedium 6.5
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fireeye.com kb.cert.org
May 25, 2022IBM InfoSphere BigInsights Invalid Input VulnerabilityCVE-2013-3993 · Other software · IBM · reported by psirt@us.ibm.comExploitedRansomwareMedium 6.5
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Product
InfoSphere BigInsights
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install IBM’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com www-01.ibm.com
May 25, 2022Microsoft Silverlight Information Disclosure VulnerabilityCVE-2013-3896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Oracle JRE Unspecified VulnerabilityCVE-2013-2423 · Other software · Oracle · reported by secalert_us@oracle.comExploitedLow 3.7
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fuseyism.com blog.spiderlabs.com
May 25, 2022Oracle JRE Sandbox Bypass VulnerabilityCVE-2013-0431 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareLow 3.7
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blogs.computerworld.com
May 25, 2022Oracle JRE Remote Code Execution VulnerabilityCVE-2013-0422 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blog.fuseyism.com
May 25, 2022Microsoft Silverlight Double Dereference VulnerabilityCVE-2013-0074 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Oracle Fusion Middleware Unspecified VulnerabilityCVE-2012-1710 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
Product
Fusion Middleware
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mandriva.com oracle.com
May 25, 2022Red Hat JBoss Information Disclosure VulnerabilityCVE-2010-1428 · Other software · Red Hat · reported by Red HatExploitedRansomwareHigh 7.5
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
May 25, 2022Oracle JRE Unspecified VulnerabilityCVE-2010-0840 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog itrc.hp.com lists.apple.com
May 25, 2022Red Hat JBoss Authentication Bypass VulnerabilityCVE-2010-0738 · Other software · Red Hat · reported by Red HatExploitedRansomwareMedium 5.3
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info public.support.unisys.com
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19943 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareHigh 8
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022Apple iOS Information Disclosure VulnerabilityCVE-2016-4655 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com lists.apple.com
May 24, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2018-8611 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19953 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareMedium 6.1
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022QNAP NAS File Station Command Injection VulnerabilityCVE-2018-19949 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022Microsoft Windows SMBv1 Information Disclosure VulnerabilityCVE-2017-0147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Product
SMBv1 server
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 24, 2022Microsoft XML Core Services Information Disclosure VulnerabilityCVE-2017-0022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
Product
XML Core Services
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCVE-2017-0005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2017-0149 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2017-0210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Artifex Ghostscript Type Confusion VulnerabilityCVE-2017-8291 · Other software · Artifex · reported by MITREExploitedHigh 7.8
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Product
Ghostscript
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Artifex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com debian.org
May 24, 2022Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2017-8543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Kaseya VSA SQL Injection VulnerabilityCVE-2017-18362 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 9.8
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
Product
Virtual System/Server Administrator (VSA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archive.today github.com
May 24, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2016-0162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityCVE-2016-3351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer and Edge
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Apple iOS Memory Corruption VulnerabilityCVE-2016-4656 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Apple iOS Webkit Memory Corruption VulnerabilityCVE-2016-4657 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow VulnerabilityCVE-2016-6366 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityCVE-2016-6367 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 24, 2022Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityCVE-2016-3298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2021-30883 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
Product
Multiple Products
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Adobe Flash Player Stack-based Buffer Overflow VulnerabilityCVE-2018-5002 · Other software · Adobe · reported by AdobeExploitedHigh 7.8
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Product
Flash Player
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Microsoft Update Notification Manager Privilege Escalation VulnerabilityCVE-2020-0638 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Product
Update Notification Manager
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Apple Multiple Products Memory Corruption VulnerabilityCVE-2019-7286 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Product
Multiple Products
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Apple iOS Memory Corruption VulnerabilityCVE-2019-7287 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
Product
iOS
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Microsoft Windows AppX Deployment Service Privilege Escalation VulnerabilityCVE-2019-1130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Cisco IOS XR Open Port VulnerabilityCVE-2022-20821 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Product
IOS XR
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
May 23, 2022Android Kernel Use-After-Free VulnerabilityCVE-2021-1048 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8
Android kernel contains a use-after-free vulnerability that allows for privilege escalation.
Product
Kernel
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
May 23, 2022Android Kernel Race Condition VulnerabilityCVE-2021-0920 · Computers, phones & browsers · Android · reported by security@android.comExploitedMedium 6.4
Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.
Product
Kernel
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.debian.org source.android.com
May 23, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2020-1027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
May 23, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2019-0676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 23, 2022Google Chrome Blink Use-After-Free VulnerabilityCVE-2019-5786 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5
Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.
Product
Chrome Blink
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
May 23, 2022Microsoft Windows SMB Information Disclosure VulnerabilityCVE-2019-0703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2019-0880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Google Chrome WebAudio Use-After-Free VulnerabilityCVE-2019-13720 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Product
Chrome WebAudio
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
May 23, 2022Mozilla Firefox and Thunderbird Type Confusion VulnerabilityCVE-2019-11707 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 8.8
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
Product
Firefox and Thunderbird
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugzilla.mozilla.org security.gentoo.org
May 23, 2022Mozilla Firefox and Thunderbird Sandbox Escape VulnerabilityCVE-2019-11708 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedCritical 10
Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
Product
Firefox and Thunderbird
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bugzilla.mozilla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.