Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,137 results · page 6 of 23

May 13, 2025Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2025-32709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Scripting Engine Type Confusion VulnerabilityCVE-2025-30397 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
May 12, 2025TeleMessage TM SGNL Hidden Functionality VulnerabilityCVE-2025-47729 · Other software · TeleMessage · reported by MITREExploitedLow 1.9
TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
Product
TM SGNL
On CISA’s list since
May 12, 2025 (federal fix deadline Jun 2, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com news.ycombinator.com
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-11120 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-6047 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 5, 2025Langflow Missing Authentication VulnerabilityCVE-2025-3248 · Other software · Langflow · reported by VulnCheckExploitedRansomwareCritical 9.8
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Product
Langflow
On CISA’s list since
May 5, 2025 (federal fix deadline May 26, 2025)
What to do
Attackers are using this now. Install Langflow’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 2, 2025Yiiframework Yii Improper Protection of Alternate Path VulnerabilityCVE-2024-58136 · Other software · Yiiframework · reported by MITREExploitedCritical 9
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
Product
Yii
On CISA’s list since
May 2, 2025 (federal fix deadline May 23, 2025)
What to do
Attackers are using this now. Install Yiiframework’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 1, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2023-44221 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.2
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Product
SMA100 Appliances
On CISA’s list since
May 1, 2025 (federal fix deadline May 22, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 28, 2025Broadcom Brocade Fabric OS Code Injection VulnerabilityCVE-2025-1976 · Other software · Broadcom · reported by sirt@brocade.comExploitedHigh 8.6
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
Product
Brocade Fabric OS
On CISA’s list since
Apr 28, 2025 (federal fix deadline May 19, 2025)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Apr 17, 2025Apple Multiple Products Memory Corruption VulnerabilityCVE-2025-31200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
Product
Multiple Products
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Apr 16, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2021-20035 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedMedium 6.5
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Product
SMA100 Appliances
On CISA’s list since
Apr 16, 2025 (federal fix deadline May 7, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 7, 2025CrushFTP Authentication Bypass VulnerabilityCVE-2025-31161 · Other software · CrushFTP · reported by MITREExploitedRansomwareCritical 9.8
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
Product
CrushFTP
On CISA’s list since
Apr 7, 2025 (federal fix deadline Apr 28, 2025)
What to do
Attackers are using this now. Install CrushFTP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog crushftp.com outpost24.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Product
action-setup GitHub Action
On CISA’s list since
Mar 24, 2025 (federal fix deadline Apr 14, 2025)
What to do
Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 19, 2025NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityCVE-2024-48248 · Other software · NAKIVO · reported by MITREExploitedHigh 8.6
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
Product
Backup and Replication
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install NAKIVO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpcenter.nakivo.com labs.watchtowr.com
Mar 19, 2025Edimax IC-7100 IP Camera OS Command Injection VulnerabilityCVE-2025-1316 · Other software · Edimax · reported by ics-cert@hq.dhs.govExploitedCritical 9.3
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
IC-7100 IP Camera
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install Edimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cisa.gov cisa.gov
Mar 18, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2025-24472 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareHigh 8.1
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Product
FortiOS and FortiProxy
On CISA’s list since
Mar 18, 2025 (federal fix deadline Apr 8, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Mar 18, 2025tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30066 · Other software · tj-actions · reported by MITREExploitedHigh 8.6
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
Product
changed-files GitHub Action
On CISA’s list since
Mar 18, 2025 (federal fix deadline Apr 8, 2025)
What to do
Attackers are using this now. Install tj-actions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.gitguardian.com github.com
Mar 13, 2025Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityCVE-2025-21590 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 6.7
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
Product
Junos OS
On CISA’s list since
Mar 13, 2025 (federal fix deadline Apr 3, 2025)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cloud.google.com supportportal.juniper.net
Mar 11, 2025Microsoft Windows NTFS Information Disclosure VulnerabilityCVE-2025-24984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.6
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCVE-2025-26633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 10, 2025 Advantive VeraCore SQL Injection VulnerabilityCVE-2025-25181 · Other software · Advantive · reported by MITREExploitedMedium 5.8
Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.
Product
VeraCore
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Advantive’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advantive.my.site.com intezer.com
Mar 4, 2025VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityCVE-2025-22226 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.1
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
Product
ESXi, Workstation, and Fusion
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityCVE-2025-22224 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.3
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Product
ESXi and Workstation
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 3, 2025Hitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityCVE-2022-43769 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.8
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Mar 3, 2025Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityCVE-2022-43939 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.6
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Mar 3, 2025Cisco Small Business RV Series Routers Command Injection VulnerabilityCVE-2023-20118 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
Product
Small Business RV Series Routers
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 25, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2023-34192 · Email & office · Synacor · reported by MITREExploitedCritical 9
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Feb 25, 2025 (federal fix deadline Mar 18, 2025)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Feb 24, 2025Oracle Agile Product Lifecycle Management (PLM) Deserialization VulnerabilityCVE-2024-20953 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 8.8
Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Feb 24, 2025 (federal fix deadline Mar 17, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Feb 24, 2025Adobe ColdFusion Deserialization VulnerabilityCVE-2017-3066 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains a deserialization vulnerability in the Apache BlazeDS library that allows for arbitrary code execution.
Product
ColdFusion
On CISA’s list since
Feb 24, 2025 (federal fix deadline Mar 17, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 20, 2025Craft CMS Code Injection VulnerabilityCVE-2025-23209 · Other software · Craft CMS · reported by GitHubExploitedHigh 8
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
Product
Craft CMS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog craftcms.com github.com
Feb 18, 2025Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2025-0108 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.8
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Product
PAN-OS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com github.com
Feb 18, 2025SonicWall SonicOS SSLVPN Improper Authentication VulnerabilityCVE-2024-53704 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
Product
SonicOS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Feb 12, 2025Apple iOS and iPadOS Incorrect Authorization VulnerabilityCVE-2025-24200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 6.1
Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Product
iOS and iPadOS
On CISA’s list since
Feb 12, 2025 (federal fix deadline Mar 5, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Feb 12, 2025Mitel SIP Phones Argument Injection VulnerabilityCVE-2024-41710 · Email & office · Mitel · reported by MITREExploitedHigh 7.2
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
Product
SIP Phones
On CISA’s list since
Feb 12, 2025 (federal fix deadline Mar 5, 2025)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com mitel.com
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40891 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40890 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 11, 2025Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityCVE-2025-21418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 7, 2025Trimble Cityworks Deserialization VulnerabilityCVE-2025-0994 · Other software · Trimble · reported by ics-cert@hq.dhs.govExploitedHigh 8.6
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
Product
Cityworks
On CISA’s list since
Feb 7, 2025 (federal fix deadline Feb 28, 2025)
What to do
Attackers are using this now. Install Trimble’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog learn.assetlifecycle.trimble.com cisa.gov
Feb 6, 2025CyberoamOS (CROS) SQL Injection VulnerabilityCVE-2020-29574 · Network & remote access · Sophos · reported by MITREExploitedRansomwareCritical 9.8
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
Product
CyberoamOS
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bleepingcomputer.com cyberoam.com
Feb 6, 2025Microsoft Outlook Improper Input Validation VulnerabilityCVE-2024-21413 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
Product
Office Outlook
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 4, 2025Paessler PRTG Network Monitor Local File Inclusion VulnerabilityCVE-2018-19410 · Other software · Paessler · reported by MITREExploitedCritical 9.8
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptsecurity.com ptsecurity.com
Feb 4, 2025Paessler PRTG Network Monitor OS Command Injection VulnerabilityCVE-2018-9276 · Other software · Paessler · reported by MITREExploitedHigh 7.2
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 4, 2025Microsoft .NET Framework Information Disclosure VulnerabilityCVE-2024-29059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Product
.NET Framework
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jan 24, 2025SonicWall SMA1000 Appliances Deserialization VulnerabilityCVE-2025-23006 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
Product
SMA1000 Appliances
On CISA’s list since
Jan 24, 2025 (federal fix deadline Feb 14, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Product
Controllers
On CISA’s list since
Jan 16, 2025 (federal fix deadline Feb 6, 2025)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.aviatrix.com docs.aviatrix.com
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21335 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityCVE-2025-21333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.