Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

394 results · page 4 of 8

Mar 11, 2025Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.CVE-2025-24051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Mar 4, 2025hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.CVE-2025-26318 · Other software · TSplus · reported by MITREMedium 5.8
hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.
Product
TSplus Remote Access
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 12, 2025Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled.CVE-2025-0896 · Other software · Orthanc · reported by ics-cert@hq.dhs.govCritical 9.2
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
Product
Orthanc server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Feb 11, 2025Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2025-21410 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 R2 Service Pack 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 11, 2025Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2025-21208 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 R2 Service Pack 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 5, 2025A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email GaCVE-2025-20185 · Network & remote access · Cisco · reported by psirt@cisco.comLow 3.4
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Jan 21, 2025An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.CVE-2024-51417 · Other software · reported by MITREMedium 6.4
An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dynamic-linq.net github.com
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method underCVE-2024-26157 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 5.3
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response to the client.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter.CVE-2024-26156 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 4.8
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal.CVE-2024-26155 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 6.1
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable an attacker to perform actions on the device.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name.CVE-2024-26154 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 4.8
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 17, 2025All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF).CVE-2024-26153 · Other software · ETIC Telecom · reported by ics-cert@hq.dhs.govMedium 6.3
All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of service on the device.
Product
Remote Access Server (RAS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Jan 10, 2025Specially constructed queries targeting ETM could discover active remote access sessionsCVE-2024-47518 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.4
Specially constructed queries targeting ETM could discover active remote access sessions
Product
Arista Edge Threat Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arista.com
Dec 18, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 17, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49125 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49104 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49102 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49086 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-49085 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 23, 2024A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allCVE-2024-20495 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of client key data after the TLS session is established. An attacker could exploit this vulnerability by sending a crafted key value to an affected system over the secure TLS session. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Product
Cisco Adaptive Security Appliance (ASA) Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 23, 2024A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirCVE-2024-20493 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to ineffective handling of memory resources during the authentication process. An attacker could exploit this vulnerability by sending crafted packets, which could cause resource exhaustion of the authentication process. A successful exploit could allow the attacker to deny authentication for Remote Access SSL VPN users for several minutes, resulting in a temporary DoS condition.
Product
Cisco Adaptive Security Appliance (ASA) Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 23, 2024A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco FCVE-2024-20331 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.8
A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating. This vulnerability is due to insufficient entropy in the authentication process. An attacker could exploit this vulnerability by determining the handle of an authenticating user and using it to terminate their authentication session. A successful exploit could allow the attacker to force a user to restart the authentication process, preventing a legitimate user from establishing remote access VPN sessions.
Product
Cisco Adaptive Security Appliance (ASA) Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43611 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43608 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43607 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43593 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43592 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43589 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43564 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43549 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38265 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38261 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 8, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38212 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2008 Service Pack 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Sep 23, 2024A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.CVE-2024-0002 · Other software · PureStorage · reported by psirt@purestorage.comCritical 10
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
Product
FlashArray
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record purestorage.com
Sep 10, 2024Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityCVE-2024-38240 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityCVE-2024-38214 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38154 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 11 Version 24H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38121 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Aug 13, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-38120 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jul 9, 2024Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityCVE-2024-30079 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jul 9, 2024Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2024-30071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jun 29, 2024iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI.CVE-2024-25943 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
Product
Integrated Dell Remote Access Controller 9
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-30095 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jun 11, 2024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-30094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jun 11, 2024Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2024-30069 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Windows Remote Access Connection Manager Information Disclosure Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.