Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,754 results · page 7 of 36
Nov 4, 2025Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityCVE-2025-11371 · Other software · GladinetExploited
Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
- Product
- CentreStack and Triofox
- On CISA’s list since
- Nov 4, 2025 (federal fix deadline Nov 25, 2025)
- What to do
- Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · BroadcomExploited
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- Product
- VMware Aria Operations and VMware Tools
- On CISA’s list since
- Oct 30, 2025 (federal fix deadline Nov 20, 2025)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 30, 2025XWiki Platform Eval Injection VulnerabilityCVE-2025-24893 · Other software · XWikiExploited
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
- Product
- Platform
- On CISA’s list since
- Oct 30, 2025 (federal fix deadline Nov 20, 2025)
- What to do
- Attackers are using this now. Install XWiki’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 28, 2025Dassault Systèmes DELMIA Apriso Code Injection VulnerabilityCVE-2025-6204 · Other software · Dassault SystèmesExploited
Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
- Product
- DELMIA Apriso
- On CISA’s list since
- Oct 28, 2025 (federal fix deadline Nov 18, 2025)
- What to do
- Attackers are using this now. Install Dassault Systèmes’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 28, 2025Dassault Systèmes DELMIA Apriso Missing Authorization VulnerabilityCVE-2025-6205 · Other software · Dassault SystèmesExploited
Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
- Product
- DELMIA Apriso
- On CISA’s list since
- Oct 28, 2025 (federal fix deadline Nov 18, 2025)
- What to do
- Attackers are using this now. Install Dassault Systèmes’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 24, 2025Adobe Commerce and Magento Improper Input Validation VulnerabilityCVE-2025-54236 · Websites & servers · AdobeExploited
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
- Product
- Commerce and Magento
- On CISA’s list since
- Oct 24, 2025 (federal fix deadline Nov 14, 2025)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 24, 2025Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityCVE-2025-59287 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
- Product
- Windows
- On CISA’s list since
- Oct 24, 2025 (federal fix deadline Nov 14, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 22, 2025Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel VulnerabilityCVE-2025-61932 · Other software · MotexExploited
Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
- Product
- LANSCOPE Endpoint Manager
- On CISA’s list since
- Oct 22, 2025 (federal fix deadline Nov 12, 2025)
- What to do
- Attackers are using this now. Install Motex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 20, 2025Microsoft Windows SMB Client Improper Access Control VulnerabilityCVE-2025-33073 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
- Product
- Windows
- On CISA’s list since
- Oct 20, 2025 (federal fix deadline Nov 10, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 20, 2025Apple Multiple Products Unspecified VulnerabilityCVE-2022-48503 · Computers, phones & browsers · AppleExploited
Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- Multiple Products
- On CISA’s list since
- Oct 20, 2025 (federal fix deadline Nov 10, 2025)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2746 · Other software · KenticoExploited
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
- Product
- Xperience CMS
- On CISA’s list since
- Oct 20, 2025 (federal fix deadline Nov 10, 2025)
- What to do
- Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · KenticoExploited
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
- Product
- Xperience CMS
- On CISA’s list since
- Oct 20, 2025 (federal fix deadline Nov 10, 2025)
- What to do
- Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 20, 2025Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61884 · Other software · OracleExploitedRansomware
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
- Product
- E-Business Suite
- On CISA’s list since
- Oct 20, 2025 (federal fix deadline Nov 10, 2025)
- What to do
- Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 15, 2025Adobe Experience Manager Forms Code Execution VulnerabilityCVE-2025-54253 · Other software · AdobeExploited
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
- Product
- Experience Manager (AEM) Forms
- On CISA’s list since
- Oct 15, 2025 (federal fix deadline Nov 5, 2025)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 14, 2025IGEL OS Use of a Key Past its Expiration Date VulnerabilityCVE-2025-47827 · Other software · IGELExploited
IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- Product
- IGEL OS
- On CISA’s list since
- Oct 14, 2025 (federal fix deadline Nov 4, 2025)
- What to do
- Attackers are using this now. Install IGEL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 14, 2025Microsoft Windows Untrusted Pointer Dereference VulnerabilityCVE-2025-24990 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
- Product
- Windows
- On CISA’s list since
- Oct 14, 2025 (federal fix deadline Nov 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 14, 2025Microsoft Windows Improper Access Control VulnerabilityCVE-2025-59230 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
- Product
- Windows
- On CISA’s list since
- Oct 14, 2025 (federal fix deadline Nov 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 14, 2025SKYSEA Client View Improper Authentication VulnerabilityCVE-2016-7836 · Other software · SKYSEAExploited
SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
- Product
- Client View
- On CISA’s list since
- Oct 14, 2025 (federal fix deadline Nov 4, 2025)
- What to do
- Attackers are using this now. Install SKYSEA’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 9, 2025Grafana Path Traversal VulnerabilityCVE-2021-43798 · Other software · Grafana LabsExploited
Grafana contains a path traversal vulnerability that could allow access to local files.
- Product
- Grafana
- On CISA’s list since
- Oct 9, 2025 (federal fix deadline Oct 30, 2025)
- What to do
- Attackers are using this now. Install Grafana Labs’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 7, 2025Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCVE-2025-27915 · Email & office · SynacorExploited
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
- Product
- Zimbra Collaboration Suite (ZCS)
- On CISA’s list since
- Oct 7, 2025 (federal fix deadline Oct 28, 2025)
- What to do
- Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Linux Kernel Heap Out-of-Bounds Write VulnerabilityCVE-2021-22555 · Computers, phones & browsers · LinuxExploited
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
- Product
- Kernel
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityCVE-2010-3962 · Computers, phones & browsers · MicrosoftExploited
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- Internet Explorer
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Microsoft Windows Privilege Escalation VulnerabilityCVE-2021-43226 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
- Product
- Windows
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Microsoft Windows Out-of-Bounds Write VulnerabilityCVE-2013-3918 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- Windows
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Microsoft Windows Remote Code Execution VulnerabilityCVE-2011-3402 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
- Product
- Windows
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Mozilla Multiple Products Remote Code Execution VulnerabilityCVE-2010-3765 · Computers, phones & browsers · MozillaExploited
Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
- Product
- Multiple Products
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 6, 2025Oracle E-Business Suite Unspecified VulnerabilityCVE-2025-61882 · Other software · OracleExploitedRansomware
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
- Product
- E-Business Suite
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 2, 2025GNU Bash OS Command Injection VulnerabilityCVE-2014-6278 · Other software · GNUExploited
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
- Product
- GNU Bash
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 2, 2025Jenkins Remote Code Execution VulnerabilityCVE-2017-1000353 · Websites & servers · JenkinsExploited
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
- Product
- Jenkins
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 2, 2025Juniper ScreenOS Improper Authentication VulnerabilityCVE-2015-7755 · Network & remote access · JuniperExploited
Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
- Product
- ScreenOS
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 2, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21043 · Computers, phones & browsers · SamsungExploited
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
- Product
- Mobile Devices
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Oct 2, 2025Smartbedded Meteobridge Command Injection VulnerabilityCVE-2025-4008 · Other software · SmartbeddedExploited
Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
- Product
- Meteobridge
- On CISA’s list since
- Oct 2, 2025 (federal fix deadline Oct 23, 2025)
- What to do
- Attackers are using this now. Install Smartbedded’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 29, 2025Sudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2025-32463 · Other software · SudoExploited
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
- Product
- Sudo
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Sudo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 29, 2025Libraesva Email Security Gateway Command Injection VulnerabilityCVE-2025-59689 · Other software · LibraesvaExploited
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
- Product
- Email Security Gateway
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Libraesva’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 29, 2025Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityCVE-2025-10035 · Other software · FortraExploitedRansomware
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- Product
- GoAnywhere MFT
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 29, 2025Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution VulnerabilityCVE-2025-20352 · Network & remote access · CiscoExploited
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
- Product
- IOS and IOS XE
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 29, 2025Adminer Server-Side Request Forgery VulnerabilityCVE-2021-21311 · Other software · AdminerExploited
Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.
- Product
- Adminer
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Adminer’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 25, 2025Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityCVE-2025-20362 · Network & remote access · CiscoExploited
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
- Product
- Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- On CISA’s list since
- Sep 25, 2025 (federal fix deadline Sep 26, 2025)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 25, 2025Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityCVE-2025-20333 · Network & remote access · CiscoExploited
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
- Product
- Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- On CISA’s list since
- Sep 25, 2025 (federal fix deadline Sep 26, 2025)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 23, 2025Google Chromium V8 Type Confusion VulnerabilityCVE-2025-10585 · Computers, phones & browsers · GoogleExploited
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
- Product
- Chromium V8
- On CISA’s list since
- Sep 23, 2025 (federal fix deadline Oct 14, 2025)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 11, 2025Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data VulnerabilityCVE-2025-5086 · Other software · Dassault SystèmesExploited
Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
- Product
- DELMIA Apriso
- On CISA’s list since
- Sep 11, 2025 (federal fix deadline Oct 2, 2025)
- What to do
- Attackers are using this now. Install Dassault Systèmes’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 4, 2025Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityCVE-2025-38352 · Computers, phones & browsers · LinuxExploited
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
- Product
- Kernel
- On CISA’s list since
- Sep 4, 2025 (federal fix deadline Sep 25, 2025)
- What to do
- Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 4, 2025Android Runtime Use-After-Free VulnerabilityCVE-2025-48543 · Computers, phones & browsers · AndroidExploited
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
- Product
- Runtime
- On CISA’s list since
- Sep 4, 2025 (federal fix deadline Sep 25, 2025)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 4, 2025Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilityCVE-2025-53690 · Other software · SitecoreExploited
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
- Product
- Multiple Products
- On CISA’s list since
- Sep 4, 2025 (federal fix deadline Sep 25, 2025)
- What to do
- Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 3, 2025TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityCVE-2023-50224 · Network & remote access · TP-LinkExploited
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- TL-WR841N
- On CISA’s list since
- Sep 3, 2025 (federal fix deadline Sep 24, 2025)
- What to do
- Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-LinkExploited
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- Multiple Routers
- On CISA’s list since
- Sep 3, 2025 (federal fix deadline Sep 24, 2025)
- What to do
- Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 2, 2025Meta Platforms WhatsApp Incorrect Authorization VulnerabilityCVE-2025-55177 · Other software · Meta PlatformsExploited
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
- Product
- On CISA’s list since
- Sep 2, 2025 (federal fix deadline Sep 23, 2025)
- What to do
- Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Sep 2, 2025TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityCVE-2020-24363 · Network & remote access · TP-LinkExploited
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Product
- TL-WA855RE
- On CISA’s list since
- Sep 2, 2025 (federal fix deadline Sep 23, 2025)
- What to do
- Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Aug 29, 2025Sangoma FreePBX Authentication Bypass VulnerabilityCVE-2025-57819 · Other software · SangomaExploited
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
- Product
- FreePBX
- On CISA’s list since
- Aug 29, 2025 (federal fix deadline Sep 19, 2025)
- What to do
- Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Aug 26, 2025Citrix NetScaler Memory Overflow VulnerabilityCVE-2025-7775 · Network & remote access · CitrixExploited
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
- Product
- NetScaler
- On CISA’s list since
- Aug 26, 2025 (federal fix deadline Aug 28, 2025)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.