Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

816 results · page 5 of 17

Feb 6, 2025Sophos XG Firewall Buffer Overflow VulnerabilityCVE-2020-15069 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
Product
XG Firewall
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.sophos.com community.sophos.com
Feb 4, 2025Microsoft .NET Framework Information Disclosure VulnerabilityCVE-2024-29059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Product
.NET Framework
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jan 29, 2025Apple Multiple Products Use-After-Free VulnerabilityCVE-2025-24085 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 10
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Product
Multiple Products
On CISA’s list since
Jan 29, 2025 (federal fix deadline Feb 19, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21335 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Jan 8, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-0282 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedRansomwareCritical 9
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Jan 8, 2025 (federal fix deadline Jan 15, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cloud.google.com
Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim Systems · reported by MITREExploitedHigh 8.1
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
Product
USAHERDS
On CISA’s list since
Dec 23, 2024 (federal fix deadline Jan 13, 2025)
What to do
Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com acclaimsystems.com
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 18, 2024Reolink Multiple IP Cameras OS Command Injection VulnerabilityCVE-2019-11001 · Other software · Reolink · reported by MITREExploitedHigh 7.2
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
Product
Multiple IP Cameras
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com vdoo.com
Dec 18, 2024Reolink RLC-410W IP Camera OS Command Injection Vulnerability CVE-2021-40407 · Other software · Reolink · reported by talos-cna@cisco.comExploitedHigh 7.2
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
Product
RLC-410W IP Camera
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog talosintelligence.com talosintelligence.com
Dec 16, 2024Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Dec 13, 2024Cleo Multiple Products Unrestricted File Upload VulnerabilityCVE-2024-50623 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
Product
Multiple Products
On CISA’s list since
Dec 13, 2024 (federal fix deadline Jan 3, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com cisa.gov
Dec 4, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51378 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
Product
CyberPanel
On CISA’s list since
Dec 4, 2024 (federal fix deadline Dec 25, 2024)
What to do
Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org cwe.mitre.org
Dec 3, 2024Zyxel Multiple Firewalls Path Traversal VulnerabilityCVE-2024-11667 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedRansomwareHigh 7.5
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
Product
Multiple Firewalls
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Dec 3, 2024North Grid Proself Improper Restriction of XML External Entity (XXE) Reference VulnerabilityCVE-2023-45727 · Other software · North Grid · reported by vultures@jpcert.or.jpExploitedHigh 7.5
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
Product
Proself
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install North Grid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp proself.jp
Nov 21, 2024Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityCVE-2024-21287 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Nov 21, 2024 (federal fix deadline Dec 12, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Nov 20, 2024VMware vCenter Server Privilege Escalation VulnerabilityCVE-2024-38813 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.5
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
Product
vCenter Server
On CISA’s list since
Nov 20, 2024 (federal fix deadline Dec 11, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Nov 20, 2024VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38812 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
Product
vCenter Server
On CISA’s list since
Nov 20, 2024 (federal fix deadline Dec 11, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Nov 18, 2024Progress Kemp LoadMaster OS Command Injection VulnerabilityCVE-2024-1212 · Other software · Progress · reported by security@progress.comExploitedCritical 10
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Product
Kemp LoadMaster
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog freeloadbalancer.com kemptechnologies.com
Nov 12, 2024Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityCVE-2024-43451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Product
Windows
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Nov 7, 2024Nostromo nhttpd Directory Traversal VulnerabilityCVE-2019-16278 · Other software · Nostromo · reported by MITREExploitedCritical 9.8
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
Product
nhttpd
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Nostromo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 7, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51567 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
Product
CyberPanel
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org cwe.mitre.org
Oct 24, 2024Cisco ASA and FTD Denial-of-Service VulnerabilityCVE-2024-20481 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.8
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Oct 24, 2024 (federal fix deadline Nov 14, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 22, 2024Microsoft SharePoint Deserialization VulnerabilityCVE-2024-38094 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.2
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Product
SharePoint
On CISA’s list since
Oct 22, 2024 (federal fix deadline Nov 12, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 17, 2024Veeam Backup and Replication Deserialization VulnerabilityCVE-2024-40711 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Product
Backup & Replication
On CISA’s list since
Oct 17, 2024 (federal fix deadline Nov 7, 2024)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com labs.watchtowr.com
Oct 15, 2024SolarWinds Web Help Desk Hardcoded Credential VulnerabilityCVE-2024-28987 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.1
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
Product
Web Help Desk
On CISA’s list since
Oct 15, 2024 (federal fix deadline Nov 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Oct 15, 2024Mozilla Firefox Use-After-Free VulnerabilityCVE-2024-9680 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedRansomwareCritical 9.8
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
Product
Firefox
On CISA’s list since
Oct 15, 2024 (federal fix deadline Nov 5, 2024)
What to do
Attackers are using this now. Install Mozilla’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugzilla.mozilla.org msrc.microsoft.com
Oct 8, 2024Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2024-43047 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.
Product
Multiple Chipsets
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 18, 2024Oracle WebLogic Server Remote Code Execution VulnerabilityCVE-2020-14644 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Product
WebLogic Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Sep 18, 2024Microsoft SQL Server Reporting Services Remote Code Execution VulnerabilityCVE-2020-0618 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
Product
SQL Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 17, 2024Adobe Flash Player Double Free VulnerablityCVE-2014-0502 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Product
Flash Player
On CISA’s list since
Sep 17, 2024 (federal fix deadline Oct 8, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com lists.opensuse.org
Sep 17, 2024Adobe Flash Player Incorrect Default Permissions VulnerabilityCVE-2013-0643 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
Product
Flash Player
On CISA’s list since
Sep 17, 2024 (federal fix deadline Oct 8, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Sep 16, 2024Progress WhatsUp Gold SQL Injection VulnerabilityCVE-2024-6670 · Other software · Progress · reported by security@progress.comExploitedRansomwareCritical 9.8
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Product
WhatsUp Gold
On CISA’s list since
Sep 16, 2024 (federal fix deadline Oct 7, 2024)
What to do
Attackers are using this now. Install Progress’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.progress.com progress.com
Sep 10, 2024Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure VulnerabilityCVE-2024-38217 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
Product
Windows
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com elastic.co
Sep 10, 2024Microsoft Publisher Protection Mechanism Failure VulnerabilityCVE-2024-38226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
Product
Publisher
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 27, 2024Apache OFBiz Incorrect Authorization VulnerabilityCVE-2024-38856 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Product
OFBiz
On CISA’s list since
Aug 27, 2024 (federal fix deadline Sep 17, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Aug 23, 2024Versa Director Dangerous File Type Upload VulnerabilityCVE-2024-39717 · Other software · Versa · reported by support@hackerone.comExploitedHigh 7.2
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Product
Director
On CISA’s list since
Aug 23, 2024 (federal fix deadline Sep 13, 2024)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog versa-networks.com cisa.gov
Aug 21, 2024Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2021-31196 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.2
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33045 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33044 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Aug 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-38213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Project Remote Code Execution Vulnerability CVE-2024-38189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.
Product
Project
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 7, 2024Android Kernel Remote Code Execution VulnerabilityCVE-2024-36971 · Computers, phones & browsers · Android · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
Product
Kernel
On CISA’s list since
Aug 7, 2024 (federal fix deadline Aug 28, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Jul 30, 2024VMware ESXi Authentication Bypass VulnerabilityCVE-2024-37085 · Other software · VMware · reported by security@vmware.comExploitedRansomwareMedium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Product
ESXi
On CISA’s list since
Jul 30, 2024 (federal fix deadline Aug 20, 2024)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Jul 29, 2024Acronis Cyber Infrastructure (ACI) Insecure Default Password VulnerabilityCVE-2023-45249 · Other software · Acronis · reported by security@acronis.comExploitedCritical 9.8
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
Product
Cyber Infrastructure (ACI)
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install Acronis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security-advisory.acronis.com securityweek.com
Jul 23, 2024Twilio Authy Information Disclosure VulnerabilityCVE-2024-39891 · Other software · Twilio · reported by MITREExploitedMedium 5.3
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Product
Authy
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Twilio’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org bleepingcomputer.com
Jul 23, 2024Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2012-4792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.
Product
Internet Explorer
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blogs.technet.com
Jul 17, 2024VMware vCenter Server Incorrect Default File Permissions Vulnerability CVE-2022-22948 · Other software · VMware · reported by security@vmware.comExploitedMedium 6.5
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Product
vCenter Server
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.