Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

644 results · page 4 of 13

Feb 20, 2025Palo Alto Networks PAN-OS File Read VulnerabilityCVE-2025-0111 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 7.1
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Product
PAN-OS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Feb 13, 2025SimpleHelp Path Traversal VulnerabilityCVE-2024-57727 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.5
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
Product
SimpleHelp
On CISA’s list since
Feb 13, 2025 (federal fix deadline Mar 6, 2025)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Feb 12, 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityCVE-2025-24200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.1
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Product
iOS and iPadOS
On CISA’s list since
Feb 12, 2025 (federal fix deadline Mar 5, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 7, 2025Trimble Cityworks Deserialization VulnerabilityCVE-2025-0994 · Other software · Trimble · reported by ics-cert@hq.dhs.govExploitedHigh 8.6
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
Product
Cityworks
On CISA’s list since
Feb 7, 2025 (federal fix deadline Feb 28, 2025)
What to do
Attackers are using this now. Install Trimble’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog learn.assetlifecycle.trimble.com cisa.gov
Feb 4, 2025Paessler PRTG Network Monitor Local File Inclusion VulnerabilityCVE-2018-19410 · Other software · Paessler · reported by MITREExploitedCritical 9.8
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptsecurity.com ptsecurity.com
Feb 4, 2025Paessler PRTG Network Monitor OS Command Injection VulnerabilityCVE-2018-9276 · Other software · Paessler · reported by MITREExploitedHigh 7.2
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 29, 2025Apple Multiple Products Use-After-Free VulnerabilityCVE-2025-24085 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 10
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Product
Multiple Products
On CISA’s list since
Jan 29, 2025 (federal fix deadline Feb 19, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Product
Controllers
On CISA’s list since
Jan 16, 2025 (federal fix deadline Feb 6, 2025)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.aviatrix.com docs.aviatrix.com
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Jan 7, 2025Oracle WebLogic Server Unspecified VulnerabilityCVE-2020-2883 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
Product
WebLogic Server
On CISA’s list since
Jan 7, 2025 (federal fix deadline Jan 28, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 18, 2024Reolink Multiple IP Cameras OS Command Injection VulnerabilityCVE-2019-11001 · Other software · Reolink · reported by MITREExploitedHigh 7.2
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
Product
Multiple IP Cameras
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com vdoo.com
Dec 17, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Product
Multiple Products
On CISA’s list since
Dec 17, 2024 (federal fix deadline Jan 7, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com support.cleo.com
Dec 13, 2024Cleo Multiple Products Unrestricted File Upload VulnerabilityCVE-2024-50623 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
Product
Multiple Products
On CISA’s list since
Dec 13, 2024 (federal fix deadline Jan 3, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com cisa.gov
Dec 10, 2024Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2024-49138 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 10, 2024 (federal fix deadline Dec 31, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstorm.news
Dec 3, 2024Zyxel Multiple Firewalls Path Traversal VulnerabilityCVE-2024-11667 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedRansomwareHigh 7.5
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
Product
Multiple Firewalls
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Nov 21, 2024Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityCVE-2024-21287 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Nov 21, 2024Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityCVE-2024-44309 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.3
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
Product
Multiple Products
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Nov 21, 2024Apple Multiple Products Code Execution VulnerabilityCVE-2024-44308 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Nov 20, 2024VMware vCenter Server Privilege Escalation VulnerabilityCVE-2024-38813 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.5
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
Product
vCenter Server
On CISA’s list since
Nov 20, 2024 (federal fix deadline Dec 11, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Nov 12, 2024Metabase GeoJSON API Local File Inclusion VulnerabilityCVE-2021-41277 · Other software · Metabase · reported by GitHubExploitedCritical 10
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
Product
Metabase
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Metabase’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Nov 12, 2024Microsoft Windows Task Scheduler Privilege Escalation VulnerabilityCVE-2024-49039 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
Product
Windows
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Nov 7, 2024Android Framework Privilege Escalation VulnerabilityCVE-2024-43093 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.3
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
Product
Framework
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog android.googlesource.com source.android.com
Oct 9, 2024Fortinet Multiple Products Format String VulnerabilityCVE-2024-23113 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
Multiple Products
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 8, 2024Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2024-43047 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.
Product
Multiple Chipsets
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Sep 30, 2024DrayTek Multiple Vigor Routers OS Command Injection VulnerabilityCVE-2020-15415 · Network & remote access · DrayTek · reported by MITREExploitedCritical 9.8
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
Product
Multiple Vigor Routers
On CISA’s list since
Sep 30, 2024 (federal fix deadline Oct 21, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com draytek.com
Sep 18, 2024Oracle WebLogic Server Remote Code Execution VulnerabilityCVE-2020-14644 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Product
WebLogic Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Sep 18, 2024Oracle ADF Faces Deserialization of Untrusted Data VulnerabilityCVE-2022-21445 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.
Product
ADF Faces
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Sep 17, 2024Adobe Flash Player Double Free VulnerablityCVE-2014-0502 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Product
Flash Player
On CISA’s list since
Sep 17, 2024 (federal fix deadline Oct 8, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com lists.opensuse.org
Sep 10, 2024Microsoft Windows Installer Improper Privilege Management VulnerabilityCVE-2024-38014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Aug 28, 2024Google Chromium V8 Inappropriate Implementation VulnerabilityCVE-2024-7965 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Aug 28, 2024 (federal fix deadline Sep 18, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Aug 26, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-7971 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Aug 26, 2024 (federal fix deadline Sep 16, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Aug 23, 2024Versa Director Dangerous File Type Upload VulnerabilityCVE-2024-39717 · Other software · Versa · reported by support@hackerone.comExploitedHigh 7.2
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Product
Director
On CISA’s list since
Aug 23, 2024 (federal fix deadline Sep 13, 2024)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog versa-networks.com cisa.gov
Aug 13, 2024Microsoft Windows Power Dependency Coordinator Privilege Escalation VulnerabilityCVE-2024-38107 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2024-38106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation VulnerabilityCVE-2024-38193 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Jul 29, 2024ServiceNow Incomplete List of Disallowed Inputs VulnerabilityCVE-2024-5217 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.2
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
Product
Utah, Vancouver, and Washington DC Now Platform
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.servicenow.com support.servicenow.com
Jul 17, 2024VMware vCenter Server Incorrect Default File Permissions Vulnerability CVE-2022-22948 · Other software · VMware · reported by security@vmware.comExploitedMedium 6.5
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Product
vCenter Server
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Jul 9, 2024Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2024-23692 · Other software · Rejetto · reported by VulnCheckExploitedRansomwareCritical 9.8
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
Product
HTTP File Server
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Rejetto’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com mohemiv.com
Jul 9, 2024Microsoft Windows Hyper-V Privilege Escalation VulnerabilityCVE-2024-38080 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 13, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Product
Telerik Report Server
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.telerik.com docs.telerik.com
Jun 13, 2024Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityCVE-2024-26169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 13, 2024Android Pixel Privilege Escalation VulnerabilityCVE-2024-32896 · Computers, phones & browsers · Android · reported by dsap-vuln-management@google.comExploitedHigh 7.8
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
Product
Pixel
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Jun 3, 2024Oracle WebLogic Server OS Command Injection VulnerabilityCVE-2017-3506 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.4
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Product
WebLogic Server
On CISA’s list since
Jun 3, 2024 (federal fix deadline Jun 24, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
May 29, 2024Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityCVE-2024-4978 · Other software · Justice AV Solutions · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.7
Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
Product
Viewer
On CISA’s list since
May 29, 2024 (federal fix deadline Jun 19, 2024)
What to do
Attackers are using this now. Install Justice AV Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twitter.com javs.com
May 28, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-5274 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
May 28, 2024 (federal fix deadline Jun 18, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
May 20, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-4947 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Product
Chromium V8
On CISA’s list since
May 20, 2024 (federal fix deadline Jun 10, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
May 16, 2024Google Chromium V8 Out-of-Bounds Memory Write VulnerabilityCVE-2024-4761 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
May 16, 2024 (federal fix deadline Jun 6, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
May 14, 2024 Microsoft DWM Core Library Privilege Escalation VulnerabilityCVE-2024-30051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.
Product
DWM Core Library
On CISA’s list since
May 14, 2024 (federal fix deadline Jun 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.