Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

229 results · page 4 of 5

Apr 14, 2022VMware Workspace ONE Access and Identity Manager Server-Side Template Injection VulnerabilityCVE-2022-22954 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Product
Workspace ONE Access and Identity Manager
On CISA’s list since
Apr 14, 2022 (federal fix deadline May 5, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Apr 11, 2022QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityCVE-2020-2509 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedCritical 9.8
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Product
QNAP Network-Attached Storage (NAS)
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install QNAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 31, 2022Dasan GPON Routers Command Injection VulnerabilityCVE-2018-10562 · Other software · Dasan · reported by MITREExploitedRansomwareCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 28, 2022Microsoft Windows Adobe Type Manager Library Remote Code Execution VulnerabilityCVE-2015-2426 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com kb.cert.org
Mar 25, 2022Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Mar 25, 2022D-Link DIR-610 Devices Remote Command ExecutionCVE-2020-9377 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
Product
DIR-610 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gist.github.com supportannouncement.us.dlink.com
Mar 25, 2022Zyxel Multiple NAS Devices OS Command Injection VulnerabilityCVE-2020-9054 · Network & remote access · Zyxel · reported by cret@cert.orgExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org kb.cert.org
Mar 25, 2022Apache Kylin OS Command Injection VulnerabilityCVE-2020-1956 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Product
Kylin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com community.sonarsource.com
Mar 25, 2022D-Link Multiple Routers Command Injection VulnerabilityCVE-2019-16920 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Product
Multiple Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com medium.com
Mar 25, 2022Webmin Command Injection VulnerabilityCVE-2019-15107 · Other software · Webmin · reported by MITREExploitedRansomwareCritical 9.8
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
Product
Webmin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Webmin’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Citrix SD-WAN and NetScaler Command Injection VulnerabilityCVE-2019-12991 · Network & remote access · Citrix · reported by MITREExploitedHigh 8.8
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022PHP FastCGI Process Manager (FPM) Buffer Overflow VulnerabilityCVE-2019-11043 · Websites & servers · PHP · reported by security@php.netExploitedRansomwareHigh 8.7
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
Product
FastCGI Process Manager (FPM)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install PHP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 25, 2022VMware SD-WAN Edge by VeloCloud Command Injection VulnerabilityCVE-2018-6961 · Other software · VMware · reported by security@vmware.comExploitedHigh 8.1
VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.
Product
SD-WAN Edge
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022LG N1A1 NAS Remote Command Execution VulnerabilityCVE-2018-14839 · Other software · LG · reported by MITREExploitedCritical 9.8
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
Product
N1A1 NAS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install LG’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog medium.com medium.com
Mar 25, 2022Quest KACE System Management Appliance Remote Command Execution VulnerabilityCVE-2018-11138 · Other software · Quest · reported by MITREExploitedRansomwareCritical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Product
KACE System Management Appliance
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Quest’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog coresecurity.com exploit-db.com
Mar 25, 2022NETGEAR DGN2200 Devices OS Command Injection VulnerabilityCVE-2017-6334 · Network & remote access · NETGEAR · reported by MITREExploitedHigh 8.8
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
Product
DGN2200 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 25, 2022NETGEAR Multiple WAP Devices Command Injection VulnerabilityCVE-2016-1555 · Network & remote access · NETGEAR · reported by cret@cert.orgExploitedCritical 9.8
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
Product
Wireless Access Point (WAP) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Mar 25, 2022D-Link DCS-930L Devices OS Command Injection VulnerabilityCVE-2016-11021 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.2
setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
Product
DCS-930L Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exploit-db.com exploit-db.com
Mar 25, 2022Cisco Prime Data Center Network Manager (DCNM) Directory Traversal VulnerabilityCVE-2015-0666 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.
Product
Prime Data Center Network Manager (DCNM)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com securitytracker.com
Mar 25, 2022HP Multiple Products Remote Code Execution VulnerabilityCVE-2013-4810 · Other software · Hewlett Packard (HP) · reported by hp-security-alert@hp.comExploitedCritical 9.8
HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.
Product
ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog h20565.www2.hp.com marc.info
Mar 25, 2022HP OpenView Network Node Manager Remote Code Execution VulnerabilityCVE-2005-2773 · Other software · Hewlett Packard (HP) · reported by MITREExploitedCritical 9.8
HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.
Product
OpenView Network Node Manager
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
Mar 15, 2022Microsoft Windows Error Reporting Manager Privilege Escalation VulnerabilityCVE-2019-1315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows Transaction Manager Privilege Escalation VulnerabilityCVE-2017-0101 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Apache Tomcat Improper Privilege Management VulnerabilityCVE-2020-1938 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Product
Tomcat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Cisco IOS Software Resource Management Errors VulnerabilityCVE-2018-0161 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.3
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Siemens SIMATIC CP 1543-1 Improper Privilege Management VulnerabilityCVE-2016-8562 · Other software · Siemens · reported by MITREExploitedHigh 7.5
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.
Product
SIMATIC CP
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com siemens.com
Mar 3, 2022Microsoft Forefront TMG Remote Code Execution VulnerabilityCVE-2011-1889 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
Product
Forefront Threat Management Gateway (TMG)
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securityfocus.com
Feb 15, 2022PHPUnit Command Injection VulnerabilityCVE-2017-9841 · Websites & servers · PHPUnit · reported by MITREExploitedCritical 9.8
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Product
PHPUnit
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install PHPUnit’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog web.archive.org securityfocus.com
Jan 28, 2022Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management VulnerabilityCVE-2020-0787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
Product
Windows
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Jan 28, 2022Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityCVE-2017-5689 · Other software · Intel · reported by secure@intel.comExploitedCritical 9.8
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Product
Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Intel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25296 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25297 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25298 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022VMware Server Side Request Forgery in vRealize Operations Manager APICVE-2021-21975 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 7.5
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Product
vRealize Operations Manager API
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Jan 18, 2022System Information Library for Node.JS Command InjectionCVE-2021-21315 · Other software · Npm package · reported by GitHubExploitedHigh 7.1
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Product
System Information Library for Node.JS
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Npm package’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jan 18, 2022F5 BIG-IP Traffic Management Microkernel Buffer OverflowCVE-2021-22991 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.8
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Product
BIG-IP Traffic Management Microkernel
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.f5.com support.f5.com
Jan 18, 2022Apache Airflow Command InjectionCVE-2020-11978 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Product
Airflow
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 10, 2021Linux Kernel Improper Privilege Management VulnerabilityCVE-2019-13272 · Computers, phones & browsers · Linux · reported by MITREExploitedHigh 7.8
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Product
Kernel
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 10, 2021Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Product
Nexus Repository Manager
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.sonatype.com support.sonatype.com
Dec 1, 2021Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityCVE-2021-37415 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
Product
ManageEngine ServiceDesk Plus (SDP)
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog manageengine.com manageengine.com
Dec 1, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Product
ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com pitstop.manageengine.com
Nov 3, 2021Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityCVE-2020-1020 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021D-Link DNS-320 Device Command Injection VulnerabilityCVE-2020-25506 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
Product
DNS-320 Device
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gist.github.com supportannouncement.us.dlink.com
Nov 3, 2021Accellion FTA OS Command Injection VulnerabilityCVE-2021-27104 · Other software · Accellion · reported by MITREExploitedRansomwareCritical 9.8
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
Product
FTA
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Accellion’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com accellion.com
Nov 3, 2021Cisco HyperFlex HX Installer Virtual Machine Command Injection VulnerabilityCVE-2021-1497 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.
Product
HyperFlex HX
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityCVE-2020-0938 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Accellion FTA OS Command Injection VulnerabilityCVE-2021-27102 · Other software · Accellion · reported by MITREExploitedRansomwareHigh 7.8
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
Product
FTA
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Accellion’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com accellion.com
Nov 3, 2021Cisco HyperFlex HX Data Platform Command Injection VulnerabilityCVE-2021-1498 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
Product
HyperFlex HX
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Multiple DrayTek Vigor Routers Web Management Page VulnerabilityCVE-2020-8515 · Network & remote access · DrayTek · reported by MITREExploitedCritical 9.8
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
Product
Multiple Vigor Routers
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sku11army.blogspot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.