Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,750 results · page 24 of 35

Apr 6, 2022Microsoft HTTP Protocol Stack Remote Code Execution VulnerabilityCVE-2021-31166 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Product
HTTP Protocol Stack
On CISA’s list since
Apr 6, 2022 (federal fix deadline Apr 27, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Apr 6, 2022Microsoft SMBv1 Server Remote Code Execution VulnerabilityCVE-2017-0148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.1
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1 server
On CISA’s list since
Apr 6, 2022 (federal fix deadline Apr 27, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 4, 2022D-Link Multiple Routers Remote Code Execution VulnerabilityCVE-2021-45382 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Product
Multiple Routers
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Apr 4, 2022Spring Framework JDK 9+ Remote Code Execution VulnerabilityCVE-2022-22965 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Product
Spring Framework
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 4, 2022Apple macOS Out-of-Bounds Write VulnerabilityCVE-2022-22675 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
Product
macOS
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 4, 2022Apple macOS Out-of-Bounds Read VulnerabilityCVE-2022-22674 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
Product
macOS
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 31, 2022QNAP NAS Improper Authorization VulnerabilityCVE-2021-28799 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Product
Network Attached Storage (NAS)
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Mar 31, 2022Sophos Firewall Authentication Bypass VulnerabilityCVE-2022-1040 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Product
Firewall
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com exploit-db.com
Mar 31, 2022Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCVE-2021-34484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 31, 2022Dell dbutil Driver Insufficient Access Control VulnerabilityCVE-2021-21551 · Other software · Dell · reported by security_alert@emc.comExploitedHigh 8.8
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Product
dbutil Driver
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 31, 2022Dasan GPON Routers Command Injection VulnerabilityCVE-2018-10562 · Other software · Dasan · reported by MITREExploitedRansomwareCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 31, 2022Dasan GPON Routers Authentication Bypass VulnerabilityCVE-2018-10561 · Other software · Dasan · reported by MITREExploitedCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 28, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2017-0059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Google Chromium V8 Type Confusion VulnerabilityCVE-2022-1096 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Mar 28, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2017-0213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.3
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Debian-specific Redis Server Lua Sandbox Escape VulnerabilityCVE-2022-0543 · Other software · Redis · reported by security@debian.orgExploitedCritical 10
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Product
Debian-specific Redis Servers
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Redis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bugs.debian.org
Mar 28, 2022Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityCVE-2021-38646 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 28, 2022Microsoft Windows Event Tracing Privilege Escalation VulnerabilityCVE-2021-34486 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 28, 2022Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityCVE-2021-26085 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareMedium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Product
Confluence Server
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com
Mar 28, 2022SonicWall Secure Remote Access (SRA) SQL Injection VulnerabilityCVE-2021-20028 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Product
Secure Remote Access (SRA)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Mar 28, 2022SonicWall SMA100 Directory Traversal VulnerabilityCVE-2019-7483 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.5
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Product
SMA100
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Mar 28, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2018-8440 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Edge and Internet Explorer Type Confusion VulnerabilityCVE-2017-0037 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
Product
Edge and Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Edge Memory Corruption VulnerabilityCVE-2016-7201 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Edge
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 28, 2022Microsoft Edge Memory Corruption VulnerabilityCVE-2016-7200 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Edge
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2016-0189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Windows CSRSS Security Feature Bypass VulnerabilityCVE-2016-0151 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.
Product
Client-Server Run-time Subsystem (CSRSS)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 28, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2016-0040 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 28, 2022Microsoft Windows Adobe Type Manager Library Remote Code Execution VulnerabilityCVE-2015-2426 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com kb.cert.org
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 28, 2022Microsoft Office Uninitialized Memory Use VulnerabilityCVE-2015-1770 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
Product
Office
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2013-3660 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 7.8
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
Product
Win32k
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com archives.neohapsis.com
Mar 28, 2022Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityCVE-2013-2729 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
Product
Reader and Acrobat
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2013-2551 · Computers, phones & browsers · Microsoft · reported by MITREExploitedRansomwareHigh 8.8
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog h30499.www3.hp.com twitter.com
Mar 28, 2022Oracle Java SE Unspecified VulnerabilityCVE-2013-2465 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org h20000.www2.hp.com
Mar 28, 2022Mozilla Firefox and Thunderbird Denial-of-Service VulnerabilityCVE-2013-1690 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 8.8
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
Product
Firefox and Thunderbird
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 28, 2022Oracle Java SE Sandbox Bypass VulnerabilityCVE-2012-5076 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Microsoft Word Remote Code Execution VulnerabilityCVE-2012-2539 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
Product
Word
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Mar 28, 2022Adobe Flash Player Memory Corruption VulnerabilityCVE-2012-2034 · Other software · Adobe · reported by AdobeExploitedHigh 7.5
Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).
Product
Flash Player
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 28, 2022Oracle Fusion Middleware Unspecified VulnerabilityCVE-2012-0518 · Other software · Oracle · reported by secalert_us@oracle.comExploitedMedium 4.7
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors
Product
Fusion Middleware
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mandriva.com oracle.com
Mar 28, 2022Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation VulnerabilityCVE-2011-2005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.
Product
Ancillary Function Driver (afd.sys)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.microsoft.com oval.cisecurity.org
Mar 28, 2022Microsoft Windows Kernel Stack-Based Buffer Overflow VulnerabilityCVE-2010-4398 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 7.8
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog isc.sans.edu nakedsecurity.sophos.com
Mar 25, 2022Citrix Multiple Products Remote Code Execution VulnerabilityCVE-2017-6316 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Product
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityCVE-2009-0927 · Email & office · Adobe · reported by MITREExploitedHigh 8.8
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Product
Reader and Acrobat
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 25, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-21999 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 25, 2022Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2020-2021 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Product
PAN-OS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.