Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

407 results · page 5 of 9

Jul 7, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2021-29256 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Jul 7, 2023 (federal fix deadline Jul 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Jun 29, 2023D-Link DIR-859 Router Command Execution VulnerabilityCVE-2019-17621 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Product
DIR-859 Router
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com medium.com
Jun 29, 2023D-Link DWL-2600AP Access Point Command Injection VulnerabilityCVE-2019-20500 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.8
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Product
DWL-2600AP Access Point
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com exploit-db.com
Jun 29, 2023Samsung Mobile Devices Out-of-Bounds Read VulnerabilityCVE-2021-25487 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 7.3
Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 23, 2023Zyxel Multiple NAS Devices Command Injection VulnerabilityCVE-2023-27992 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
Jun 22, 2023Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free VulnerabilityCVE-2016-9079 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 7.5
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
Product
Firefox, Firefox ESR, and Thunderbird
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com rhn.redhat.com
Jun 22, 2023Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-35730 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.debian.org github.com
Jun 13, 2023Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityCVE-2023-27997 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Product
FortiOS and FortiProxy SSL-VPN
On CISA’s list since
Jun 13, 2023 (federal fix deadline Jul 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
May 22, 2023Apple Multiple Products WebKit Out-of-Bounds Read VulnerabilityCVE-2023-28204 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.5
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
May 22, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-32373 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
May 22, 2023 (federal fix deadline Jun 12, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
May 19, 2023Cisco IOS Denial-of-Service VulnerabilityCVE-2004-1464 · Network & remote access · Cisco · reported by MITREExploitedMedium 5.9
Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.
Product
IOS
On CISA’s list since
May 19, 2023 (federal fix deadline Jun 9, 2023)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securitytracker.com
May 1, 2023TP-Link Archer AX-21 Command Injection VulnerabilityCVE-2023-1389 · Network & remote access · TP-Link · reported by vulnreport@tenable.comExploitedHigh 8.8
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
Product
Archer AX21
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
Apr 17, 2023Apple macOS Use-After-Free VulnerabilityCVE-2019-8526 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
Product
macOS
On CISA’s list since
Apr 17, 2023 (federal fix deadline May 8, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 10, 2023Apple Multiple Products WebKit Use-After-Free VulnerabilityCVE-2023-28205 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
Multiple Products
On CISA’s list since
Apr 10, 2023 (federal fix deadline May 1, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 10, 2023Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write VulnerabilityCVE-2023-28206 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.6
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Apr 10, 2023 (federal fix deadline May 1, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 3, 2023Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2022-27926 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Apr 3, 2023 (federal fix deadline Apr 24, 2023)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Mar 30, 2023Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) VulnerabilityCVE-2022-39197 · Other software · Fortra · reported by MITREExploitedMedium 6.1
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Product
Cobalt Strike
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cobaltstrike.com cobaltstrike.com
Mar 30, 2023Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityCVE-2021-30900 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 30, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2022-38181 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com developer.arm.com
Mar 30, 2023Linux Kernel Use-After-Free VulnerabilityCVE-2023-0266 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comExploitedHigh 7.9
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
Product
Kernel
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org github.com
Mar 30, 2023Google Chromium Network Service Use-After-Free VulnerabilityCVE-2022-3038 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Network Service
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com chromereleases.googleblog.com
Feb 10, 2023Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityCVE-2015-2291 · Other software · Intel · reported by MITREExploitedRansomwareHigh 7.8
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Product
Ethernet Diagnostics Driver for Windows
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Intel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Feb 2, 2023Oracle E-Business Suite Unspecified VulnerabilityCVE-2022-21587 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Product
E-Business Suite
On CISA’s list since
Feb 2, 2023 (federal fix deadline Feb 23, 2023)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Dec 13, 2022Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVE-2022-42475 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Product
FortiOS
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Oct 25, 2022Apple iOS and iPadOS Out-of-Bounds Write VulnerabilityCVE-2022-42827 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Oct 25, 2022 (federal fix deadline Nov 15, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 30, 2022Microsoft Exchange Server Server-Side Request Forgery VulnerabilityCVE-2022-41040 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Sep 30, 2022 (federal fix deadline Oct 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Sep 15, 2022Code Aurora ACDB Audio Driver Stack-based Buffer Overflow VulnerabilityCVE-2013-2597 · Other software · Code Aurora · reported by MITREExploitedHigh 8.4
The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.
Product
ACDB Audio Driver
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Code Aurora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog codeaurora.org codeaurora.org
Sep 8, 2022D-Link DIR-820L Remote Code Execution VulnerabilityCVE-2022-26258 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
Product
DIR-820L
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 8, 2022MikroTik RouterOS Stack-Based Buffer Overflow VulnerabilityCVE-2018-7445 · Network & remote access · MikroTik · reported by MITREExploitedCritical 9.8
In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.
Product
RouterOS
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org securityfocus.com
Sep 8, 2022D-Link Multiple Routers OS Command Injection VulnerabilityCVE-2018-6530 · Network & remote access · D-Link · reported by MITREExploitedRansomwareCritical 9.8
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
Product
Multiple Routers
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp2.dlink.com ftp2.dlink.com
Sep 8, 2022D-Link DIR-300 Router Cleartext Storage of a Password VulnerabilityCVE-2011-4723 · Network & remote access · D-Link · reported by MITREExploitedMedium 5.7
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
Product
DIR-300 Router
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog en.securitylab.ru en.securitylab.ru
Aug 22, 2022Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service VulnerabilityCVE-2022-0028 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.6
A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
Product
PAN-OS
On CISA’s list since
Aug 22, 2022 (federal fix deadline Sep 12, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Aug 18, 2022Apple iOS and macOS Out-of-Bounds Write VulnerabilityCVE-2022-32894 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
Product
iOS and macOS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Aug 18, 2022Apple iOS and macOS Out-of-Bounds Write VulnerabilityCVE-2022-32893 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
Product
iOS and macOS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Aug 18, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2017-15944 · Network & remote access · Palo Alto Networks · reported by MITREExploitedCritical 9.8
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Product
PAN-OS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Jul 29, 2022Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityCVE-2022-26138 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.8
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Product
Confluence
On CISA’s list since
Jul 29, 2022 (federal fix deadline Aug 19, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog confluence.atlassian.com jira.atlassian.com
Jun 27, 2022Apple Multiple Products Use-After-Free VulnerabilityCVE-2019-8605 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Product
Multiple Products
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jun 27, 2022Red Hat Polkit Out-of-Bounds Read and Write VulnerabilityCVE-2021-4034 · Other software · Red Hat · reported by Red HatExploitedRansomwareHigh 7.8
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Product
Polkit
On CISA’s list since
Jun 27, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 8, 2022Google Chromium V8 Out-of-Bounds Memory VulnerabilityCVE-2016-5198 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com securityfocus.com
Jun 8, 2022Google Chromium V8 Out-of-Bounds Write VulnerabilityCVE-2019-5825 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5
Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com chromereleases.googleblog.com
Jun 8, 2022Google Chromium V8 Out-of-Bounds Write VulnerabilityCVE-2018-17480 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Jun 8, 2022Google Chromium V8 Out-of-Bounds Read VulnerabilityCVE-2016-1646 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog googlechromereleases.blogspot.com lists.opensuse.org
Jun 8, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2012-4969 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.1
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.vulnhunt.com dev.metasploit.com
Jun 8, 2022Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityCVE-2012-0767 · Other software · Adobe · reported by AdobeExploitedMedium 6.1
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Product
Flash Player
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Jun 8, 2022Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityCVE-2010-2883 · Email & office · Adobe · reported by AdobeExploitedHigh 7.3
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.metasploit.com community.websense.com
Jun 8, 2022Adobe Acrobat and Reader Use-After-Free VulnerabilityCVE-2009-4324 · Email & office · Adobe · reported by AdobeExploitedHigh 7.8
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com contagiodump.blogspot.com
May 25, 2022Adobe Flash Player and AIR Use-After-Free VulnerabilityCVE-2016-0984 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
Product
Flash Player and AIR
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19953 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareMedium 6.1
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19943 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareHigh 8
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 23, 2022Adobe Flash Player Stack-based Buffer Overflow VulnerabilityCVE-2018-5002 · Other software · Adobe · reported by AdobeExploitedHigh 7.8
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Product
Flash Player
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.