Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

277new WordPress flaws this week

393,915entries in the database

683 results · page 8 of 14

Oct 4, 2023JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2023-42793 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Product
TeamCity
On CISA’s list since
Oct 4, 2023 (federal fix deadline Oct 25, 2023)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Oct 2, 2023Google Chromium libvpx Heap Buffer Overflow VulnerabilityCVE-2023-5217 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Product
Chromium libvpx
On CISA’s list since
Oct 2, 2023 (federal fix deadline Oct 23, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 28, 2023Red Hat JBoss RichFaces Framework Expression Language Injection VulnerabilityCVE-2018-14667 · Other software · Red Hat · reported by Red HatExploitedCritical 9.8
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Product
JBoss RichFaces Framework
On CISA’s list since
Sep 28, 2023 (federal fix deadline Oct 19, 2023)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Sep 13, 2023Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access VulnerabilityCVE-2023-20269 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 5
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
Product
Adaptive Security Appliance and Firepower Threat Defense
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 13, 2023Google Chromium WebP Heap-Based Buffer Overflow VulnerabilityCVE-2023-4863 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Product
Chromium WebP
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Sep 11, 2023Apple iOS, iPadOS, and watchOS Wallet Code Execution VulnerabilityCVE-2023-41061 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
Product
iOS, iPadOS, and watchOS
On CISA’s list since
Sep 11, 2023 (federal fix deadline Oct 2, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 6, 2023Apache RocketMQ Command Execution VulnerabilityCVE-2023-33246 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Product
RocketMQ
On CISA’s list since
Sep 6, 2023 (federal fix deadline Sep 27, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Aug 24, 2023Ignite Realtime Openfire Path Traversal VulnerabilityCVE-2023-32315 · Other software · Ignite Realtime · reported by GitHubExploitedHigh 8.6
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Product
Openfire
On CISA’s list since
Aug 24, 2023 (federal fix deadline Sep 14, 2023)
What to do
Attackers are using this now. Install Ignite Realtime’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Aug 22, 2023Ivanti Sentry Authentication Bypass VulnerabilityCVE-2023-38035 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Product
Sentry
On CISA’s list since
Aug 22, 2023 (federal fix deadline Sep 12, 2023)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.ivanti.com
Aug 22, 2023Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityCVE-2023-27532 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareHigh 7.5
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
Product
Backup & Replication
On CISA’s list since
Aug 22, 2023 (federal fix deadline Sep 12, 2023)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com veeam.com
Aug 16, 2023Citrix Content Collaboration ShareFile Improper Access Control VulnerabilityCVE-2023-24489 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Product
Content Collaboration
On CISA’s list since
Aug 16, 2023 (federal fix deadline Sep 6, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Aug 7, 2023Zyxel P660HN-T1A Routers Command Injection VulnerabilityCVE-2017-18368 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
Product
P660HN-T1A Routers
On CISA’s list since
Aug 7, 2023 (federal fix deadline Aug 28, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com raw.githubusercontent.com
Jul 31, 2023Ivanti Endpoint Manager Mobile (EPMM) Path Traversal VulnerabilityCVE-2023-35081 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Jul 31, 2023 (federal fix deadline Aug 21, 2023)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jul 25, 2023Ivanti Endpoint Manager Mobile Authentication Bypass VulnerabilityCVE-2023-35078 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Jul 25, 2023 (federal fix deadline Aug 15, 2023)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jul 17, 2023Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2023-36884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
Product
Windows
On CISA’s list since
Jul 17, 2023 (federal fix deadline Aug 29, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Jul 11, 2023Microsoft Windows MSHTML Platform Privilege Escalation VulnerabilityCVE-2023-32046 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Jul 7, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2021-29256 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Jul 7, 2023 (federal fix deadline Jul 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Jun 29, 2023Samsung Mobile Devices Improper Boundary Check VulnerabilityCVE-2021-25372 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 23, 2023VMware Tools Authentication Bypass VulnerabilityCVE-2023-20867 · Other software · VMware · reported by security@vmware.comExploitedLow 3.9
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
Product
Tools
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Jun 23, 2023Zyxel Multiple NAS Devices Command Injection VulnerabilityCVE-2023-27992 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
Jun 22, 2023Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free VulnerabilityCVE-2016-9079 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 7.5
Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
Product
Firefox, Firefox ESR, and Thunderbird
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com rhn.redhat.com
Jun 13, 2023Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityCVE-2023-27997 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Product
FortiOS and FortiProxy SSL-VPN
On CISA’s list since
Jun 13, 2023 (federal fix deadline Jul 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jun 7, 2023Google Chromium V8 Type Confusion VulnerabilityCVE-2023-3079 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 7, 2023 (federal fix deadline Jun 28, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 12, 2023Red Hat Polkit Incorrect Authorization VulnerabilityCVE-2021-3560 · Other software · Red Hat · reported by Red HatExploitedHigh 7.8
Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.
Product
Polkit
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 12, 2023Apache Tomcat Remote Code Execution VulnerabilityCVE-2016-8735 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Product
Tomcat
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com seclists.org
May 1, 2023TP-Link Archer AX-21 Command Injection VulnerabilityCVE-2023-1389 · Network & remote access · TP-Link · reported by vulnreport@tenable.comExploitedHigh 8.8
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
Product
Archer AX21
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
May 1, 2023Apache Log4j2 Deserialization of Untrusted Data VulnerabilityCVE-2021-45046 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
Product
Log4j2
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Apr 21, 2023Google Chrome Skia Integer Overflow VulnerabilityCVE-2023-2136 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Product
Chromium Skia
On CISA’s list since
Apr 21, 2023 (federal fix deadline May 12, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Apr 17, 2023Google Chromium V8 Type Confusion VulnerabilityCVE-2023-2033 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Apr 17, 2023 (federal fix deadline May 8, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Apr 7, 2023Veritas Backup Exec Agent Improper Authentication VulnerabilityCVE-2021-27877 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.2
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
Product
Backup Exec Agent
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com veritas.com
Apr 7, 2023Arm Mali GPU Kernel Driver Information Disclosure VulnerabilityCVE-2023-26083 · Computers, phones & browsers · Arm · reported by MITREExploitedLow 3.3
Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com cybersecurity-help.cz
Mar 30, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2022-38181 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com developer.arm.com
Mar 30, 2023Google Chromium Network Service Use-After-Free VulnerabilityCVE-2022-3038 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Network Service
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com chromereleases.googleblog.com
Mar 30, 2023Arm Mali GPU Kernel Driver Unspecified VulnerabilityCVE-2022-22706 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 7.8
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Mar 14, 2023Fortinet FortiOS Path Traversal VulnerabilityCVE-2022-41328 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 6.7
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
Product
FortiOS
On CISA’s list since
Mar 14, 2023 (federal fix deadline Apr 4, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Mar 7, 2023Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityCVE-2022-28810 · Email & office · Zoho · reported by MITREExploitedMedium 6.8
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Product
ManageEngine
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Mar 7, 2023Apache Spark Command Injection VulnerabilityCVE-2022-33891 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Product
Spark
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Feb 14, 2023Microsoft Office Publisher Security Feature Bypass VulnerabilityCVE-2023-21715 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Product
Office
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 14, 2023Microsoft Windows Graphic Component Privilege Escalation VulnerabilityCVE-2023-21823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 10, 2023Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityCVE-2015-2291 · Other software · Intel · reported by MITREExploitedRansomwareHigh 7.8
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Product
Ethernet Diagnostics Driver for Windows
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Intel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Feb 10, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · Fortra · reported by cve@rapid7.comExploitedRansomwareHigh 7.2
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Product
GoAnywhere MFT
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Jan 23, 2023Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-47966 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Product
ManageEngine
On CISA’s list since
Jan 23, 2023 (federal fix deadline Feb 13, 2023)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2023Microsoft Exchange Server Privilege Escalation VulnerabilityCVE-2022-41080 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Jan 10, 2023 (federal fix deadline Jan 31, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Dec 13, 2022Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVE-2022-42475 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Product
FortiOS
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 13, 2022Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCVE-2022-27518 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Product
Application Delivery Controller (ADC) and Gateway
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Dec 5, 2022Google Chromium V8 Type Confusion VulnerabilityCVE-2022-4262 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Dec 5, 2022 (federal fix deadline Dec 26, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 28, 2022Google Chromium GPU Heap Buffer Overflow VulnerabilityCVE-2022-4135 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium GPU
On CISA’s list since
Nov 28, 2022 (federal fix deadline Dec 19, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 14, 2022Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2022-41049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Product
Windows
On CISA’s list since
Nov 14, 2022 (federal fix deadline Dec 9, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 8, 2022Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2022-41091 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Product
Windows
On CISA’s list since
Nov 8, 2022 (federal fix deadline Dec 9, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 28, 2022Google Chromium V8 Type Confusion VulnerabilityCVE-2022-3723 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Oct 28, 2022 (federal fix deadline Nov 18, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.