Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

1,613 results · page 26 of 33

Mar 3, 2022Adobe Flash Player Remote Code Execution VulnerabilityCVE-2011-0611 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com bugix-security.blogspot.com
Mar 3, 2022Microsoft Office Stack-based Buffer Overflow VulnerabilityCVE-2010-3333 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.idefense.com secunia.com
Mar 3, 2022Microsoft Windows Kernel Exception Handler VulnerabilityCVE-2010-0232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com lists.immunitysec.com
Mar 3, 2022Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityCVE-2010-0188 · Email & office · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org secunia.com
Mar 3, 2022Microsoft Excel Featheader Record Memory Corruption VulnerabilityCVE-2009-3129 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
Product
Excel
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com labs.idefense.com
Mar 3, 2022Microsoft Windows Improper Input Validation VulnerabilityCVE-2009-1123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Mar 3, 2022Oracle VirtualBox Insufficient Input Validation VulnerabilityCVE-2008-3431 · Other software · Oracle · reported by MITREExploitedHigh 8.8
An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.
Product
VirtualBox
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securityreason.com
Mar 3, 2022Adobe Reader and Acrobat Input Validation VulnerabilityCVE-2008-2992 · Email & office · Adobe · reported by MITREExploitedRansomwareHigh 7.8
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
Product
Acrobat and Reader
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog download.oracle.com lists.opensuse.org
Mar 3, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2004-0210 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 7.8
A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.cert.org us-cert.gov
Mar 3, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2002-0367 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 7.8
smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info iss.net
Feb 25, 2022Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting VulnerabilityCVE-2022-24682 · Email & office · Synacor · reported by MITREExploitedRansomwareMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
Product
Zimbra Collaborate Suite (ZCS)
On CISA’s list since
Feb 25, 2022 (federal fix deadline Mar 11, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.zimbra.com wiki.zimbra.com
Feb 25, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-8570 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.
Product
Office
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com github.com
Feb 25, 2022Microsoft Internet Explorer Remote Code Execution VulnerabilityCVE-2017-0222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.
Product
Internet Explorer
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 25, 2022Microsoft Windows Code Injection VulnerabilityCVE-2014-6352 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.
Product
Windows
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
Feb 22, 2022Zabbix Frontend Authentication Bypass VulnerabilityCVE-2022-23131 · Other software · Zabbix · reported by security@zabbix.comExploitedCritical 9.1
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.
Product
Frontend
On CISA’s list since
Feb 22, 2022 (federal fix deadline Mar 8, 2022)
What to do
Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.zabbix.com support.zabbix.com
Feb 22, 2022Zabbix Frontend Improper Access Control VulnerabilityCVE-2022-23134 · Other software · Zabbix · reported by security@zabbix.comExploitedLow 3.7
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
Product
Frontend
On CISA’s list since
Feb 22, 2022 (federal fix deadline Mar 8, 2022)
What to do
Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.debian.org lists.fedoraproject.org
Feb 15, 2022Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityCVE-2022-24086 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Feb 15, 2022 (federal fix deadline Mar 1, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Feb 15, 2022Google Chromium Animation Use-After-Free VulnerabilityCVE-2022-0609 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Animation
On CISA’s list since
Feb 15, 2022 (federal fix deadline Mar 1, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Feb 15, 2022Microsoft Internet Explorer Type Confusion VulnerabilityCVE-2019-0752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
Product
Internet Explorer
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Feb 15, 2022Microsoft Windows VBScript Engine Out-of-Bounds Write VulnerabilityCVE-2018-8174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"
Product
Windows
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com blog.0patch.com
Feb 15, 2022PHPUnit Command Injection VulnerabilityCVE-2017-9841 · Websites & servers · PHPUnit · reported by MITREExploitedCritical 9.8
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Product
PHPUnit
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install PHPUnit’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog web.archive.org securityfocus.com
Feb 15, 2022Microsoft Word Memory Corruption VulnerabilityCVE-2014-1761 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.
Product
Word
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog technet.microsoft.com docs.microsoft.com
Feb 15, 2022Microsoft Graphics Component Memory Corruption VulnerabilityCVE-2013-3906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
Product
Graphics Component
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.mcafee.com blogs.technet.com
Feb 11, 2022Apple iOS, iPadOS, and macOS Webkit Use-After-Free VulnerabilityCVE-2022-22620 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Feb 11, 2022 (federal fix deadline Feb 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
Feb 10, 2022Apache Struts 1 Improper Input Validation VulnerabilityCVE-2017-9791 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Product
Struts 1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog struts.apache.org oracle.com
Feb 10, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-0262 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office.
Product
Office
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Feb 10, 2022Microsoft Windows SAM Local Privilege Escalation VulnerabilityCVE-2021-36934 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
Product
Windows
On CISA’s list since
Feb 10, 2022 (federal fix deadline Feb 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Feb 10, 2022Microsoft SMBv3 Remote Code Execution VulnerabilityCVE-2020-0796 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 10
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Product
SMBv3
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022Microsoft Windows Shell (.lnk) Remote Code Execution VulnerabilityCVE-2017-8464 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
Product
Windows
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 10, 2022Oracle Corporation WebLogic Server Remote Code Execution VulnerabilityCVE-2017-10271 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedRansomwareHigh 7.5
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Product
WebLogic Server
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Feb 10, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2017-0263 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
Product
Win32k
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 10, 2022Microsoft SMBv1 Remote Code Execution VulnerabilityCVE-2017-0145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022Microsoft SMBv1 Remote Code Execution VulnerabilityCVE-2017-0144 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2016-3088 · Websites & servers · Apache · reported by Red HatExploitedCritical 9.8
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Product
ActiveMQ
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org rhn.redhat.com
Feb 10, 2022D-Link DIR-645 Router Remote Code Execution VulnerabilityCVE-2015-2051 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Product
DIR-645 Router
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityadvisories.dlink.com securityfocus.com
Feb 10, 2022Microsoft HTTP.sys Remote Code Execution VulnerabilityCVE-2015-1635 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
Product
HTTP.sys
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com osvdb.org
Feb 10, 2022Apple OS X Authentication Bypass VulnerabilityCVE-2015-1130 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
Product
OS X
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com osvdb.org
Feb 4, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2022-21882 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Product
Win32k
On CISA’s list since
Feb 4, 2022 (federal fix deadline Feb 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Jan 28, 2022Apple Memory Corruption VulnerabilityCVE-2022-22587 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
Product
iOS and macOS
On CISA’s list since
Jan 28, 2022 (federal fix deadline Feb 11, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jan 28, 2022SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilityCVE-2021-20038 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
Product
SMA 100 Appliances
On CISA’s list since
Jan 28, 2022 (federal fix deadline Feb 11, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com psirt.global.sonicwall.com
Jan 28, 2022Grandstream Networks UCM6200 Series SQL Injection VulnerabilityCVE-2020-5722 · Other software · Grandstream · reported by vulnreport@tenable.comExploitedCritical 9.8
Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.
Product
UCM6200
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Grandstream’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 28, 2022Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management VulnerabilityCVE-2020-0787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
Product
Windows
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Jan 28, 2022Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityCVE-2017-5689 · Other software · Intel · reported by secure@intel.comExploitedCritical 9.8
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Product
Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Intel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Jan 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2014-1776 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
Product
Internet Explorer
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
Jan 28, 2022GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-6271 · Other software · GNU · reported by security@debian.orgExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
Product
Bourne-Again Shell (Bash)
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org archives.neohapsis.com
Jan 28, 2022GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-7169 · Other software · GNU · reported by MITREExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
Product
Bourne-Again Shell (Bash)
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org archives.neohapsis.com
Jan 21, 2022Apache Struts 1 ActionForm Denial-of-Service VulnerabilityCVE-2006-1547 · Websites & servers · Apache · reported by Red HatExploitedHigh 7.5
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Product
Struts 1
On CISA’s list since
Jan 21, 2022 (federal fix deadline Jul 21, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.suse.com
Jan 21, 2022Apache Struts 2 Improper Input Validation VulnerabilityCVE-2012-0391 · Websites & servers · Apache · reported by MITREExploitedCritical 9.8
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Product
Struts 2
On CISA’s list since
Jan 21, 2022 (federal fix deadline Jul 21, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com secunia.com
Jan 21, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2018-8453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
Product
Win32k
On CISA’s list since
Jan 21, 2022 (federal fix deadline Jul 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Jan 18, 2022F5 BIG-IP Traffic Management Microkernel Buffer OverflowCVE-2021-22991 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.8
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Product
BIG-IP Traffic Management Microkernel
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.f5.com support.f5.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.