Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

816 results · page 4 of 17

Aug 13, 2025N-able N-Central Insecure Deserialization VulnerabilityCVE-2025-8875 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.
Product
N-Central
On CISA’s list since
Aug 13, 2025 (federal fix deadline Aug 20, 2025)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.n-able.com cisa.gov
Aug 12, 2025Microsoft Office Excel Remote Code Execution VulnerabilityCVE-2007-0671 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Product
Office
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Aug 12, 2025Microsoft Internet Explorer Resource Management Errors VulnerabilityCVE-2013-3893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
Jul 28, 2025PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityCVE-2023-2533 · Other software · PaperCut · reported by help@fluidattacks.comExploitedHigh 8.4
PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.
Product
NG/MF
On CISA’s list since
Jul 28, 2025 (federal fix deadline Aug 18, 2025)
What to do
Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fluidattacks.com papercut.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2775 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2776 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 22, 2025Microsoft SharePoint Code Injection VulnerabilityCVE-2025-49704 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Product
SharePoint
On CISA’s list since
Jul 22, 2025 (federal fix deadline Jul 23, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 22, 2025Microsoft SharePoint Improper Authentication VulnerabilityCVE-2025-49706 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Product
SharePoint
On CISA’s list since
Jul 22, 2025 (federal fix deadline Jul 23, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 20, 2025Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVE-2025-53770 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Product
SharePoint
On CISA’s list since
Jul 20, 2025 (federal fix deadline Jul 21, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com arstechnica.com
Jul 10, 2025Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityCVE-2025-5777 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.3
Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jul 10, 2025 (federal fix deadline Jul 11, 2025)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com citrixbleed.com
Jul 7, 2025Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilityCVE-2019-9621 · Email & office · Synacor · reported by MITREExploitedHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Jul 1, 2025TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityCVE-2025-48927 · Other software · TeleMessage · reported by MITREExploitedMedium 5.3
TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Jun 25, 2025Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityCVE-2019-6693 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 6.5
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Product
FortiOS
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jun 5, 2025Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityCVE-2025-5419 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 5, 2025 (federal fix deadline Jun 26, 2025)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21479 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21480 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 3, 2025Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2025-27038 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.5
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 2, 2025ConnectWise ScreenConnect Improper Authentication VulnerabilityCVE-2025-3935 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49ExploitedHigh 8.1
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
Product
ScreenConnect
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ConnectWise’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog connectwise.com connectwise.com
May 19, 2025Srimax Output Messenger Directory Traversal VulnerabilityCVE-2025-27920 · Other software · Srimax · reported by MITREExploitedHigh 7.2
Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Product
Output Messenger
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Srimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog outputmessenger.com srimax.com
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-32701 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows DWM Core Library Use-After-Free VulnerabilityCVE-2025-30400 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2025-32709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 6, 2025FreeType Out-of-Bounds Write VulnerabilityCVE-2025-27363 · Other software · FreeType · reported by cve-assign@fb.comExploitedHigh 8.1
FreeType contains an out-of-bounds write vulnerability when attempting to parse font subglyph structures related to TrueType GX and variable font files that may allow for arbitrary code execution.
Product
FreeType
On CISA’s list since
May 6, 2025 (federal fix deadline May 27, 2025)
What to do
Attackers are using this now. Install FreeType’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog facebook.com openwall.com
Apr 29, 2025SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2025-31324 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 10
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Product
NetWeaver
On CISA’s list since
Apr 29, 2025 (federal fix deadline May 20, 2025)
What to do
Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog me.sap.com url.sap
Apr 17, 2025Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityCVE-2025-24054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Apr 17, 2025Apple Multiple Products Arbitrary Read and Write VulnerabilityCVE-2025-31201 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Product
Multiple Products
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 9, 2025Linux Kernel Out-of-Bounds Read VulnerabilityCVE-2024-53150 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.1
Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
Product
Kernel
On CISA’s list since
Apr 9, 2025 (federal fix deadline Apr 30, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Apr 8, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-29824 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 8, 2025Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityCVE-2025-30406 · Other software · Gladinet · reported by MITREExploitedCritical 9
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Product
CentreStack
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gladinetsupport.s3.us-east-1.amazonaws.com centrestack.com
Apr 4, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-22457 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedRansomwareCritical 9
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Apr 4, 2025 (federal fix deadline Apr 11, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 31, 2025Cisco Smart Licensing Utility Static Credential VulnerabilityCVE-2024-20439 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Product
Smart Licensing Utility
On CISA’s list since
Mar 31, 2025 (federal fix deadline Apr 21, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Product
action-setup GitHub Action
On CISA’s list since
Mar 24, 2025 (federal fix deadline Apr 14, 2025)
What to do
Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 19, 2025SAP NetWeaver Directory Traversal VulnerabilityCVE-2017-12637 · Network & remote access · SAP · reported by MITREExploitedHigh 7.5
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Product
NetWeaver
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog web.archive.org cisa.gov
Mar 19, 2025NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityCVE-2024-48248 · Other software · NAKIVO · reported by MITREExploitedHigh 8.6
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
Product
Backup and Replication
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install NAKIVO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpcenter.nakivo.com labs.watchtowr.com
Mar 11, 2025Microsoft Windows NTFS Out-Of-Bounds Read VulnerabilityCVE-2025-24991 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows NTFS Information Disclosure VulnerabilityCVE-2025-24984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.6
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows Win32k Use-After-Free VulnerabilityCVE-2025-24983 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 10, 2025Advantive VeraCore Unrestricted File Upload VulnerabilityCVE-2024-57968 · Other software · Advantive · reported by MITREExploitedCritical 9.9
Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.
Product
VeraCore
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Advantive’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advantive.my.site.com intezer.com
Mar 10, 2025 Advantive VeraCore SQL Injection VulnerabilityCVE-2025-25181 · Other software · Advantive · reported by MITREExploitedMedium 5.8
Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
Product
VeraCore
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Advantive’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advantive.my.site.com intezer.com
Mar 4, 2025VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityCVE-2025-22226 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.1
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
Product
ESXi, Workstation, and Fusion
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025VMware ESXi Arbitrary Write VulnerabilityCVE-2025-22225 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 8.2
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
Product
ESXi
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityCVE-2025-22224 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.3
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Product
ESXi and Workstation
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025Linux Kernel Use of Uninitialized Resource VulnerabilityCVE-2024-50302 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedMedium 5.5
The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.
Product
Kernel
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Mar 3, 2025Progress WhatsUp Gold Path Traversal VulnerabilityCVE-2024-4885 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.
Product
WhatsUp Gold
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.progress.com progress.com
Mar 3, 2025Microsoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityCVE-2018-8639 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Product
Windows
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Feb 20, 2025Palo Alto Networks PAN-OS File Read VulnerabilityCVE-2025-0111 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 7.1
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Product
PAN-OS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Feb 12, 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityCVE-2025-24200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.1
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Product
iOS and iPadOS
On CISA’s list since
Feb 12, 2025 (federal fix deadline Mar 5, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.