Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

197 results · page 3 of 4

May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Product
GitLab CE/EE
On CISA’s list since
May 1, 2024 (federal fix deadline May 22, 2024)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Jan 8, 2024Joomla! Improper Access Control VulnerabilityCVE-2023-23752 · Websites & servers · Joomla! · reported by security@joomla.orgExploitedMedium 5.3
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
Product
Joomla!
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Joomla!’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.joomla.org developer.joomla.org
Nov 16, 2023Sophos Web Appliance Command Injection VulnerabilityCVE-2023-1671 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
Product
Web Appliance
On CISA’s list since
Nov 16, 2023 (federal fix deadline Dec 7, 2023)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sophos.com
Nov 14, 2023Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityCVE-2023-36033 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 14, 2023 (federal fix deadline Dec 5, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 7, 2023Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityCVE-2023-22518 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
Product
Confluence Data Center and Server
On CISA’s list since
Nov 7, 2023 (federal fix deadline Nov 28, 2023)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com confluence.atlassian.com
Sep 25, 2023Apple Multiple Products Improper Certificate Validation VulnerabilityCVE-2023-41991 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 18, 2023Realtek SDK Improper Input Validation VulnerabilityCVE-2014-8361 · Network & remote access · Realtek · reported by MITREExploitedCritical 9.8
Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
Product
SDK
On CISA’s list since
Sep 18, 2023 (federal fix deadline Oct 9, 2023)
What to do
Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp jvn.jp
Aug 24, 2023Ignite Realtime Openfire Path Traversal VulnerabilityCVE-2023-32315 · Other software · Ignite Realtime · reported by GitHubExploitedHigh 8.6
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Product
Openfire
On CISA’s list since
Aug 24, 2023 (federal fix deadline Sep 14, 2023)
What to do
Attackers are using this now. Install Ignite Realtime’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Aug 16, 2023Citrix Content Collaboration ShareFile Improper Access Control VulnerabilityCVE-2023-24489 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Product
Content Collaboration
On CISA’s list since
Aug 16, 2023 (federal fix deadline Sep 6, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-29298 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-38205 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jun 29, 2023Samsung Mobile Devices Improper Input Validation VulnerabilityCVE-2021-25489 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedLow 3.3
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Improper Boundary Check VulnerabilityCVE-2021-25372 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 22, 2023Vmware Aria Operations for Networks Command Injection VulnerabilityCVE-2023-20887 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
Product
Aria Operations for Networks
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
May 12, 2023Linux Kernel Improper Input Validation VulnerabilityCVE-2010-3904 · Computers, phones & browsers · Linux · reported by security@ubuntu.comExploitedHigh 7.8
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Product
Kernel
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org lists.opensuse.org
Apr 21, 2023PaperCut MF/NG Improper Access Control VulnerabilityCVE-2023-27350 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareCritical 9.8
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
Product
MF/NG
On CISA’s list since
Apr 21, 2023 (federal fix deadline May 12, 2023)
What to do
Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 7, 2023Veritas Backup Exec Agent Improper Authentication VulnerabilityCVE-2021-27877 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.2
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
Product
Backup Exec Agent
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com veritas.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25337 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25369 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.2
Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Sep 23, 2022Sophos Firewall Code Injection VulnerabilityCVE-2022-3236 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Product
Firewall
On CISA’s list since
Sep 23, 2022 (federal fix deadline Oct 14, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sophos.com sophos.com
Sep 15, 2022Trend Micro Apex One and Apex One as a Service Improper Validation VulnerabilityCVE-2022-40139 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.2
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
Product
Apex One and Apex One as a Service
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Sep 15, 2022Linux Kernel Improper Input Validation VulnerabilityCVE-2013-6282 · Computers, phones & browsers · Linux · reported by MITREExploitedHigh 8.8
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Product
Kernel
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org codeaurora.org
Sep 8, 2022Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityCVE-2018-13374 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 4.3
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Product
FortiOS and FortiADC
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Aug 25, 2022Delta Electronics DOPSoft 2 Improper Input Validation VulnerabilityCVE-2021-38406 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govExploitedHigh 7.8
Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.
Product
DOPSoft 2
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install Delta Electronics’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.cisa.gov us-cert.cisa.gov
Aug 25, 2022PEAR Archive_Tar Improper Link Resolution VulnerabilityCVE-2020-36193 · Other software · PEAR · reported by MITREExploitedHigh 7.5
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
Product
Archive_Tar
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com lists.debian.org
Jun 27, 2022Google Chromium PopupBlocker Security Bypass VulnerabilityCVE-2021-30533 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5
Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium PopupBlocker
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Jun 8, 2022QNAP QTS Improper Input Validation VulnerabilityCVE-2019-7193 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
Product
QTS
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com qnap.com
Jun 8, 2022QNAP Photo Station Improper Access Control VulnerabilityCVE-2019-7192 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
Product
Photo Station
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com qnap.com
May 25, 2022Microsoft Windows Open Type Font Remote Code Execution VulnerabilityCVE-2016-7256 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Cisco IOS XR Open Port VulnerabilityCVE-2022-20821 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Product
IOS XR
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
May 4, 2022OpenSSL Information Disclosure VulnerabilityCVE-2014-0160 · Websites & servers · OpenSSL · reported by Red HatExploitedHigh 7.5
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Product
OpenSSL
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install OpenSSL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org blog.fox-it.com
Mar 31, 2022QNAP NAS Improper Authorization VulnerabilityCVE-2021-28799 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Product
Network Attached Storage (NAS)
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 31, 2022Sophos Firewall Authentication Bypass VulnerabilityCVE-2022-1040 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Product
Firewall
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com exploit-db.com
Mar 31, 2022Dasan GPON Routers Command Injection VulnerabilityCVE-2018-10562 · Other software · Dasan · reported by MITREExploitedRansomwareCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 31, 2022Dasan GPON Routers Authentication Bypass VulnerabilityCVE-2018-10561 · Other software · Dasan · reported by MITREExploitedCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 28, 2022Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation VulnerabilityCVE-2011-2005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.
Product
Ancillary Function Driver (afd.sys)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.microsoft.com oval.cisecurity.org
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022OpenSMTPD Remote Code Execution VulnerabilityCVE-2020-7247 · Other software · OpenBSD · reported by MITREExploitedCritical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
Product
OpenSMTPD
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install OpenBSD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Sophos SG UTM Remote Code Execution VulnerabilityCVE-2020-25223 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
Product
SG UTM
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com community.sophos.com
Mar 25, 2022QNAP Helpdesk Improper Access Control VulnerabilityCVE-2020-2506 · Network & remote access · QNAP Systems · reported by security@qnapsecurity.com.twExploitedHigh 7.3
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
Product
Helpdesk
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install QNAP Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 25, 2022VMware Tanzu Spring Data Commons Property Binder VulnerabilityCVE-2018-1273 · Other software · VMware Tanzu · reported by security_alert@emc.comExploitedRansomwareCritical 9.8
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
Product
Spring Data Commons
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install VMware Tanzu’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mail-archives.apache.org pivotal.io
Mar 25, 2022Apache Struts Improper Input Validation VulnerabilityCVE-2013-2251 · Websites & servers · Apache · reported by Red HatExploitedCritical 9.8
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
Product
Struts
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archiva.apache.org cxsecurity.com
Mar 25, 2022HP OpenView Network Node Manager Remote Code Execution VulnerabilityCVE-2005-2773 · Other software · Hewlett Packard (HP) · reported by MITREExploitedCritical 9.8
HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.
Product
OpenView Network Node Manager
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
Mar 3, 2022Apache Tomcat Improper Privilege Management VulnerabilityCVE-2020-1938 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Product
Tomcat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Cisco Small Business Routers Improper Input Validation VulnerabilityCVE-2019-1652 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.2
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Product
Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0174 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0173 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0172 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Malware Protection Engine Improper Restriction of Operations VulnerabilityCVE-2017-8540 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Product
Malware Protection Engine
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.