Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

365new WordPress flaws this week

13,868entries in the database

1,754 results · page 5 of 36

Mar 27, 2026F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityCVE-2025-53521 · Network & remote access · F5Exploited
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Product
BIG-IP
On CISA’s list since
Mar 27, 2026 (federal fix deadline Mar 30, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 26, 2026Aquasecurity Trivy Embedded Malicious Code VulnerabilityCVE-2026-33634 · Other software · AquasecurityExploited
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Product
Trivy
On CISA’s list since
Mar 26, 2026 (federal fix deadline Apr 9, 2026)
What to do
Attackers are using this now. Install Aquasecurity’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2026Langflow Code Injection VulnerabilityCVE-2026-33017 · Other software · LangflowExploited
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Product
Langflow
On CISA’s list since
Mar 25, 2026 (federal fix deadline Apr 8, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 20, 2026Craft CMS Code Injection VulnerabilityCVE-2025-32432 · Other software · Craft CMSExploited
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Product
Craft CMS
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 20, 2026Laravel Livewire Code Injection VulnerabilityCVE-2025-54068 · Other software · LaravelExploited
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
Product
Livewire
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Laravel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 20, 2026Apple Multiple Products Improper Locking VulnerabilityCVE-2025-43510 · Computers, phones & browsers · AppleExploited
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 20, 2026Apple Multiple Products Classic Buffer Overflow VulnerabilityCVE-2025-43520 · Computers, phones & browsers · AppleExploited
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 20, 2026Apple Multiple Products Buffer Overflow VulnerabilityCVE-2025-31277 · Computers, phones & browsers · AppleExploited
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 19, 2026Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityCVE-2026-20131 · Network & remote access · CiscoExploitedRansomware
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Product
Secure Firewall Management Center (FMC)
On CISA’s list since
Mar 19, 2026 (federal fix deadline Mar 22, 2026)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 18, 2026Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilityCVE-2025-66376 · Email & office · SynacorExploited
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Mar 18, 2026 (federal fix deadline Apr 1, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 18, 2026Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVE-2026-20963 · Email & office · MicrosoftExploited
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
Product
SharePoint
On CISA’s list since
Mar 18, 2026 (federal fix deadline Mar 21, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 16, 2026Wing FTP Server Information Disclosure VulnerabilityCVE-2025-47813 · Other software · Wing FTP ServerExploited
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
Product
Wing FTP Server
On CISA’s list since
Mar 16, 2026 (federal fix deadline Mar 30, 2026)
What to do
Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 13, 2026Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCVE-2026-3910 · Computers, phones & browsers · GoogleExploited
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 13, 2026Google Skia Out-of-Bounds Write VulnerabilityCVE-2026-3909 · Computers, phones & browsers · GoogleExploited
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Product
Skia
On CISA’s list since
Mar 13, 2026 (federal fix deadline Mar 27, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8nExploited
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Product
n8n
On CISA’s list since
Mar 11, 2026 (federal fix deadline Mar 25, 2026)
What to do
Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 9, 2026Omnissa Workspace ONE Server-Side Request ForgeryCVE-2021-22054 · Other software · OmnissaExploited
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Product
Workspace One UEM
On CISA’s list since
Mar 9, 2026 (federal fix deadline Mar 23, 2026)
What to do
Attackers are using this now. Install Omnissa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 9, 2026SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2025-26399 · Other software · SolarWindsExploitedRansomware
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
Product
Web Help Desk
On CISA’s list since
Mar 9, 2026 (federal fix deadline Mar 12, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 9, 2026Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityCVE-2026-1603 · Network & remote access · IvantiExploited
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 9, 2026 (federal fix deadline Mar 23, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 5, 2026Hikvision Multiple Products Improper Authentication VulnerabilityCVE-2017-7921 · Network & remote access · HikvisionExploited
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 5, 2026Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityCVE-2021-22681 · Other software · RockwellExploited
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Rockwell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 5, 2026Apple Multiple products Use-After-Free VulnerabilityCVE-2023-43000 · Computers, phones & browsers · AppleExploited
Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 5, 2026Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCVE-2021-30952 · Computers, phones & browsers · AppleExploited
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 5, 2026Apple iOS and iPadOS Use-After-Free VulnerabilityCVE-2023-41974 · Computers, phones & browsers · AppleExploited
Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2026Broadcom VMware Aria Operations Command Injection VulnerabilityCVE-2026-22719 · Other software · BroadcomExploited
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
Product
VMware Aria Operations
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2026Qualcomm Multiple Chipsets Memory Corruption VulnerabilityCVE-2026-21385 · Computers, phones & browsers · QualcommExploited
Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.
Product
Multiple Chipsets
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 25, 2026Cisco SD-WAN Path Traversal VulnerabilityCVE-2022-20775 · Network & remote access · CiscoExploited
Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Product
SD-WAN
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 25, 2026Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCVE-2026-20127 · Network & remote access · CiscoExploited
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Product
Catalyst SD-WAN Controller and Manager
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 24, 2026Soliton Systems K.K FileZen OS Command Injection VulnerabilityCVE-2026-25108 · Other software · Soliton Systems K.KExploited
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
Product
FileZen
On CISA’s list since
Feb 24, 2026 (federal fix deadline Mar 17, 2026)
What to do
Attackers are using this now. Install Soliton Systems K.K’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 20, 2026RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · RoundcubeExploited
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
Product
Webmail
On CISA’s list since
Feb 20, 2026 (federal fix deadline Mar 13, 2026)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 20, 2026RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
Product
Webmail
On CISA’s list since
Feb 20, 2026 (federal fix deadline Mar 13, 2026)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog github.com roundcube.net
Feb 18, 2026GitLab Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-22175 · Websites & servers · GitLabExploited
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
Product
GitLab
On CISA’s list since
Feb 18, 2026 (federal fix deadline Mar 11, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 18, 2026Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCVE-2026-22769 · Other software · DellExploited
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
Product
RecoverPoint for Virtual Machines (RP4VMs)
On CISA’s list since
Feb 18, 2026 (federal fix deadline Feb 21, 2026)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 17, 2026Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilityCVE-2020-7796 · Email & office · SynacorExploited
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled.
Product
Zimbra Collaboration Suite
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 17, 2026TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2024-7694 · Other software · TeamT5Exploited
TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
Product
ThreatSonar Anti-Ransomware
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install TeamT5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 17, 2026Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 · Computers, phones & browsers · GoogleExploited
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 13, 2026BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCVE-2026-1731 · Other software · BeyondTrustExploitedRansomware
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Product
Remote Support (RS) and Privileged Remote Access (PRA)
On CISA’s list since
Feb 13, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 12, 2026Apple Multiple Buffer Overflow VulnerabilityCVE-2026-20700 · Computers, phones & browsers · AppleExploited
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
Product
Multiple Products
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 12, 2026Microsoft Configuration Manager SQL Injection VulnerabilityCVE-2024-43468 · Computers, phones & browsers · MicrosoftExploited
Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.
Product
Configuration Manager
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 12, 2026Notepad++ Download of Code Without Integrity Check VulnerabilityCVE-2025-15556 · Other software · Notepad++Exploited
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
Product
Notepad++
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Notepad++’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 12, 2026SolarWinds Web Help Desk Security Control Bypass VulnerabilityCVE-2025-40536 · Other software · SolarWindsExploited
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
Product
Web Help Desk
On CISA’s list since
Feb 12, 2026 (federal fix deadline Feb 15, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVE-2026-21513 · Computers, phones & browsers · MicrosoftExploited
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft Windows NULL Pointer Dereference VulnerabilityCVE-2026-21525 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVE-2026-21510 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft Windows Improper Privilege Management VulnerabilityCVE-2026-21533 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft Windows Type Confusion VulnerabilityCVE-2026-21519 · Computers, phones & browsers · MicrosoftExploited
Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 10, 2026Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCVE-2026-21514 · Email & office · MicrosoftExploited
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Office
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 5, 2026React Native Community CLI OS Command Injection VulnerabilityCVE-2025-11953 · Other software · React Native CommunityExploited
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Product
CLI
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install React Native Community’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 5, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterToolsExploitedRansomware
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Product
SmarterMail
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Feb 3, 2026Sangoma FreePBX OS Command Injection VulnerabilityCVE-2025-64328 · Other software · SangomaExploited
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
Product
FreePBX
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.