Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

1,762 results · page 4 of 36

Jun 5, 2026SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilityCVE-2026-28318 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 7.5
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Product
Serv-U
On CISA’s list since
Jun 5, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Jun 3, 2026Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityCVE-2026-45247 · Other software · Mirasvit · reported by VulnCheckExploitedCritical 9.3
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
Product
Mirasvit Full Page Cache Warmer
On CISA’s list since
Jun 3, 2026 (federal fix deadline Jun 6, 2026)
What to do
Attackers are using this now. Install Mirasvit’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mirasvit.com sansec.io
Jun 2, 2026Linux Kernel Improper Authentication VulnerabilityCVE-2022-0492 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Product
Kernel
On CISA’s list since
Jun 2, 2026 (federal fix deadline Jun 5, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 2, 2026Android Framework Integer Overflow VulnerabilityCVE-2025-48595 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 8.4
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
Product
Framework
On CISA’s list since
Jun 2, 2026 (federal fix deadline Jun 5, 2026)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com cisa.gov
Jun 1, 2026Oracle WebLogic Server Unspecified VulnerabilityCVE-2024-21182 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
Product
WebLogic Server
On CISA’s list since
Jun 1, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
May 29, 2026Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2026-0257 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareHigh 7.8
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
Product
PAN-OS
On CISA’s list since
May 29, 2026 (federal fix deadline Jun 1, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cert-portal.siemens.com
May 27, 2026Nx Console Embedded Malicious Code VulnerabilityCVE-2026-48027 · Other software · Nx · reported by GitHubExploitedRansomwareCritical 9.3
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Product
Nx Console
On CISA’s list since
May 27, 2026 (federal fix deadline Jun 10, 2026)
What to do
Attackers are using this now. Install Nx’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 27, 2026TanStack Unspecified VulnerabilityCVE-2026-45321 · Other software · TanStack · reported by GitHubExploitedRansomwareCritical 9.6
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
Product
TanStack
On CISA’s list since
May 27, 2026 (federal fix deadline Jun 10, 2026)
What to do
Attackers are using this now. Install TanStack’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 27, 2026Daemon Tools Lite Embedded Malicious Code VulnerabilityCVE-2026-8398 · Other software · Daemon · reported by vulnerability@kaspersky.comExploitedCritical 9.3
Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.
Product
Daemon Tools Lite
On CISA’s list since
May 27, 2026 (federal fix deadline May 30, 2026)
What to do
Attackers are using this now. Install Daemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.daemon-tools.cc securelist.com
May 26, 2026LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCVE-2026-48172 · Other software · LiteSpeed · reported by MITREExploitedCritical 10
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Product
cPanel Plugin
On CISA’s list since
May 26, 2026 (federal fix deadline May 29, 2026)
What to do
Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.litespeedtech.com litespeedtech.com
May 22, 2026Drupal Core SQL Injection VulnerabilityCVE-2026-9082 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedCritical 9.8
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Product
Core
On CISA’s list since
May 22, 2026 (federal fix deadline May 27, 2026)
What to do
Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog drupal.org cisa.gov
May 21, 2026Langflow Origin Validation Error VulnerabilityCVE-2025-34291 · Other software · Langflow · reported by VulnCheckExploitedCritical 9.4
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
Product
Langflow
On CISA’s list since
May 21, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com obsidiansecurity.com
May 21, 2026Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityCVE-2026-34926 · Other software · Trend Micro · reported by security@trendmicro.comExploitedMedium 6.7
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
Product
Apex One
On CISA’s list since
May 21, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
May 20, 2026Microsoft Defender Denial of Service VulnerabilityCVE-2026-45498 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
Product
Defender
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 20, 2026Microsoft Windows Buffer Overflow VulnerabilityCVE-2008-4250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
Product
Windows
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.securiteam.com marc.info
May 20, 2026Microsoft DirectX NULL Byte Overwrite VulnerabilityCVE-2009-1537 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
Product
DirectX
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
May 20, 2026Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityCVE-2009-3459 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Product
Acrobat and Reader
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com isc.sans.org
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0249 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com news.cnet.com
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com osvdb.org
May 20, 2026Microsoft Defender Link Following VulnerabilityCVE-2026-41091 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Defender
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 15, 2026Microsoft Exchange Server Cross-Site Scripting VulnerabilityCVE-2026-42897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
Product
Microsoft
On CISA’s list since
May 15, 2026 (federal fix deadline May 29, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 14, 2026Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCVE-2026-20182 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
Product
Catalyst SD-WAN
On CISA’s list since
May 14, 2026 (federal fix deadline May 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
May 8, 2026BerriAI LiteLLM SQL Injection VulnerabilityCVE-2026-42208 · Other software · BerriAI · reported by GitHubExploitedCritical 9.3
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
Product
LiteLLM
On CISA’s list since
May 8, 2026 (federal fix deadline May 11, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 7, 2026Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityCVE-2026-6973 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
May 7, 2026 (federal fix deadline May 10, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com cisa.gov
May 6, 2026Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityCVE-2026-0300 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.3
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Product
PAN-OS
On CISA’s list since
May 6, 2026 (federal fix deadline May 9, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cert-portal.siemens.com
May 1, 2026Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityCVE-2026-31431 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Product
Kernel
On CISA’s list since
May 1, 2026 (federal fix deadline May 15, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Apr 30, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVE-2026-41940 · WordPress plugins & themes · reported by VulnCheckExploitedRansomwareCritical 9.3
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Product
cPanel & WHM and WP2 (WordPress Squared)
On CISA’s list since
Apr 30, 2026 (federal fix deadline May 3, 2026)
What to do
Attackers are using this now. Install WebPros’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.cpanel.net docs.wpsquared.com
Apr 28, 2026Microsoft Windows Protection Mechanism Failure VulnerabilityCVE-2026-32202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 28, 2026 (federal fix deadline May 12, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 28, 2026ConnectWise ScreenConnect Path Traversal VulnerabilityCVE-2024-1708 · Other software · ConnectWise · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedRansomwareHigh 8.4
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
Product
ScreenConnect
On CISA’s list since
Apr 28, 2026 (federal fix deadline May 12, 2026)
What to do
Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog connectwise.com huntress.com
Apr 24, 2026D-Link DIR-823X Command Injection VulnerabilityCVE-2025-29635 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.2
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DIR-823X
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com akamai.com
Apr 24, 2026Samsung MagicINFO 9 Server Path Traversal VulnerabilityCVE-2024-7399 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comExploitedHigh 8.8
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
Product
MagicINFO 9 Server
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungtv.com arcticwolf.com
Apr 24, 2026SimpleHelp Path Traversal VulnerabilityCVE-2024-57728 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.2
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 24, 2026SimpleHelp Missing Authorization VulnerabilityCVE-2024-57726 · Other software · SimpleHelp · reported by MITREExploitedRansomwareCritical 9.9
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 23, 2026Marimo Remote Code Execution VulnerabilityCVE-2026-39987 · Other software · Marimo · reported by GitHubExploitedCritical 9.3
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Product
Marimo
On CISA’s list since
Apr 23, 2026 (federal fix deadline May 7, 2026)
What to do
Attackers are using this now. Install Marimo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 22, 2026Microsoft Defender Insufficient Granularity of Access Control VulnerabilityCVE-2026-33825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Product
Defender
On CISA’s list since
Apr 22, 2026 (federal fix deadline May 6, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Apr 20, 2026Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCVE-2026-20122 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.4
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Product
Catalyst SD-WAN Manger
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Kentico Xperience Path Traversal VulnerabilityCVE-2025-2749 · Other software · Kentico · reported by VulnCheckExploitedHigh 7.2
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Product
Kentico Xperience
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com labs.watchtowr.com
Apr 20, 2026PaperCut NG/MF Improper Authentication VulnerabilityCVE-2023-27351 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareHigh 7.5
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
Product
NG/MF
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog papercut.com zerodayinitiative.com
Apr 20, 2026Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCVE-2025-48700 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Apr 20, 2026Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCVE-2026-20128 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Product
KACE Systems Management Appliance (SMA)
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seralys.com
Apr 20, 2026JetBrains TeamCity Relative Path Traversal VulnerabilityCVE-2024-27199 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareHigh 7.3
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
Product
TeamCity
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com
Apr 16, 2026Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2026-34197 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Product
ActiveMQ
On CISA’s list since
Apr 16, 2026 (federal fix deadline Apr 30, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org openwall.com
Apr 14, 2026Microsoft Office Remote Code ExecutionCVE-2009-0238 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
Product
Office
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.zdnet.com isc.sans.org
Apr 14, 2026Microsoft SharePoint Server Improper Input Validation VulnerabilityCVE-2026-32201 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
SharePoint Server
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Apr 13, 2026Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityCVE-2012-1854 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
Product
Visual Basic for Applications (VBA)
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Apr 13, 2026Microsoft Windows Link Following VulnerabilityCVE-2025-60710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
Product
Windows
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 13, 2026Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVE-2023-21529 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
Product
Exchange Server
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 13, 2026Microsoft Windows Out-of-Bounds Read VulnerabilityCVE-2023-36424 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
Product
Windows
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.