Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,139 results · page 8 of 23

Sep 10, 2024Microsoft Publisher Protection Mechanism Failure VulnerabilityCVE-2024-38226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
Product
Publisher
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 9, 2024Linux Kernel PIE Stack Buffer Corruption Vulnerability CVE-2017-1000253 · Computers, phones & browsers · Linux · reported by MITREExploitedRansomwareHigh 7.8
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
Product
Kernel
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install Linux’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Sep 9, 2024ImageMagick Improper Input Validation VulnerabilityCVE-2016-3714 · Other software · ImageMagick · reported by Red HatExploitedHigh 8.4
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
Product
ImageMagick
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install ImageMagick’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.imagemagick.org lists.opensuse.org
Aug 28, 2024Google Chromium V8 Inappropriate Implementation VulnerabilityCVE-2024-7965 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Aug 28, 2024 (federal fix deadline Sep 18, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Aug 27, 2024Apache OFBiz Incorrect Authorization VulnerabilityCVE-2024-38856 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Product
OFBiz
On CISA’s list since
Aug 27, 2024 (federal fix deadline Sep 17, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Aug 26, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-7971 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Aug 26, 2024 (federal fix deadline Sep 16, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Aug 21, 2024Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2021-31196 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.2
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33045 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Aug 21, 2024Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33044 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
Product
IP Camera Firmware
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Aug 15, 2024SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2024-28986 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.8
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.
Product
Web Help Desk
On CISA’s list since
Aug 15, 2024 (federal fix deadline Sep 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Aug 13, 2024Microsoft Windows Scripting Engine Memory Corruption VulnerabilityCVE-2024-38178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Project Remote Code Execution Vulnerability CVE-2024-38189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.
Product
Project
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Windows Power Dependency Coordinator Privilege Escalation VulnerabilityCVE-2024-38107 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2024-38106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 13, 2024Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation VulnerabilityCVE-2024-38193 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Aug 7, 2024Android Kernel Remote Code Execution VulnerabilityCVE-2024-36971 · Computers, phones & browsers · Android · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
Product
Kernel
On CISA’s list since
Aug 7, 2024 (federal fix deadline Aug 28, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Aug 5, 2024Microsoft COM for Windows Deserialization of Untrusted Data VulnerabilityCVE-2018-0824 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.
Product
Windows
On CISA’s list since
Aug 5, 2024 (federal fix deadline Aug 26, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Jul 30, 2024VMware ESXi Authentication Bypass VulnerabilityCVE-2024-37085 · Other software · VMware · reported by security@vmware.comExploitedRansomwareMedium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Product
ESXi
On CISA’s list since
Jul 30, 2024 (federal fix deadline Aug 20, 2024)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Jul 29, 2024ServiceNow Improper Input Validation VulnerabilityCVE-2024-4879 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.3
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.
Product
Utah, Vancouver, and Washington DC Now Platform
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.servicenow.com support.servicenow.com
Jul 23, 2024Twilio Authy Information Disclosure VulnerabilityCVE-2024-39891 · Other software · Twilio · reported by MITREExploitedMedium 5.3
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Product
Authy
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Twilio’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org bleepingcomputer.com
Jul 17, 2024VMware vCenter Server Incorrect Default File Permissions Vulnerability CVE-2022-22948 · Other software · VMware · reported by security@vmware.comExploitedMedium 6.5
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Product
vCenter Server
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Jul 17, 2024Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityCVE-2024-34102 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com vicarius.io
Jul 15, 2024OSGeo GeoServer GeoTools Eval Injection VulnerabilityCVE-2024-36401 · Other software · OSGeo · reported by GitHubExploitedCritical 9.8
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
Product
GeoServer
On CISA’s list since
Jul 15, 2024 (federal fix deadline Aug 5, 2024)
What to do
Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jul 9, 2024Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2024-23692 · Other software · Rejetto · reported by VulnCheckExploitedRansomwareCritical 9.8
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
Product
HTTP File Server
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Rejetto’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com mohemiv.com
Jul 9, 2024Microsoft Windows Hyper-V Privilege Escalation VulnerabilityCVE-2024-38080 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 2, 2024Cisco NX-OS Command Injection VulnerabilityCVE-2024-20399 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.
Product
NX-OS
On CISA’s list since
Jul 2, 2024 (federal fix deadline Jul 23, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jun 26, 2024OSGeo GeoServer JAI-EXT Code Injection VulnerabilityCVE-2022-24816 · Other software · OSGeo · reported by GitHubExploitedCritical 10
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
Product
JAI-EXT
On CISA’s list since
Jun 26, 2024 (federal fix deadline Jul 17, 2024)
What to do
Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 13, 2024Android Pixel Privilege Escalation VulnerabilityCVE-2024-32896 · Computers, phones & browsers · Android · reported by dsap-vuln-management@google.comExploitedHigh 7.8
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
Product
Pixel
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Jun 13, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Product
Telerik Report Server
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.telerik.com docs.telerik.com
Jun 12, 2024PHP-CGI OS Command Injection VulnerabilityCVE-2024-4577 · Websites & servers · PHP Group · reported by security@php.netExploitedRansomwareCritical 9.8
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Product
PHP
On CISA’s list since
Jun 12, 2024 (federal fix deadline Jul 3, 2024)
What to do
Attackers are using this now. Install PHP Group’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com arstechnica.com
Jun 3, 2024Oracle WebLogic Server OS Command Injection VulnerabilityCVE-2017-3506 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.4
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Product
WebLogic Server
On CISA’s list since
Jun 3, 2024 (federal fix deadline Jun 24, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
May 30, 2024Check Point Quantum Security Gateways Information Disclosure VulnerabilityCVE-2024-24919 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedRansomwareHigh 8.6
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
Product
Quantum Security Gateways
On CISA’s list since
May 30, 2024 (federal fix deadline Jun 20, 2024)
What to do
Attackers are using this now. Install Check Point’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com support.checkpoint.com
May 29, 2024Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityCVE-2024-4978 · Other software · Justice AV Solutions · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.7
Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
Product
Viewer
On CISA’s list since
May 29, 2024 (federal fix deadline Jun 19, 2024)
What to do
Attackers are using this now. Install Justice AV Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twitter.com javs.com
May 28, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-5274 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
May 28, 2024 (federal fix deadline Jun 18, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
May 20, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2024-4947 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Product
Chromium V8
On CISA’s list since
May 20, 2024 (federal fix deadline Jun 10, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
May 20, 2024NextGen Healthcare Mirth Connect Deserialization of Untrusted Data VulnerabilityCVE-2023-43208 · Other software · NextGen Healthcare · reported by MITREExploitedRansomwareCritical 9.8
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
Product
Mirth Connect
On CISA’s list since
May 20, 2024 (federal fix deadline Jun 10, 2024)
What to do
Attackers are using this now. Install NextGen Healthcare’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com horizon3.ai
May 16, 2024D-Link DIR-605 Router Information Disclosure VulnerabilityCVE-2021-40655 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.5
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
Product
DIR-605 Router
On CISA’s list since
May 16, 2024 (federal fix deadline Jun 6, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com dlink.com
May 14, 2024 Microsoft DWM Core Library Privilege Escalation VulnerabilityCVE-2024-30051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.
Product
DWM Core Library
On CISA’s list since
May 14, 2024 (federal fix deadline Jun 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Product
GitLab CE/EE
On CISA’s list since
May 1, 2024 (federal fix deadline May 22, 2024)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Apr 24, 2024Cisco ASA and FTD Privilege Escalation VulnerabilityCVE-2024-20359 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Apr 24, 2024 (federal fix deadline May 1, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 23, 2024Microsoft Windows Print Spooler Privilege Escalation Vulnerability CVE-2022-38028 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.
Product
Windows
On CISA’s list since
Apr 23, 2024 (federal fix deadline May 14, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Apr 12, 2024Palo Alto Networks PAN-OS Command Injection VulnerabilityCVE-2024-3400 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Apr 12, 2024 (federal fix deadline Apr 19, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Apr 11, 2024D-Link Multiple NAS Devices Command Injection VulnerabilityCVE-2024-3273 · Network & remote access · D-Link · reported by VulDBExploitedHigh 7.3
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Product
Multiple NAS Devices
On CISA’s list since
Apr 11, 2024 (federal fix deadline May 2, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Apr 4, 2024Android Pixel Privilege Escalation VulnerabilityCVE-2024-29748 · Computers, phones & browsers · Android · reported by dsap-vuln-management@google.comExploitedHigh 7.8
Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.
Product
Pixel
On CISA’s list since
Apr 4, 2024 (federal fix deadline Apr 25, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Apr 4, 2024Android Pixel Information Disclosure VulnerabilityCVE-2024-29745 · Computers, phones & browsers · Android · reported by dsap-vuln-management@google.comExploitedMedium 5.5
Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
Product
Pixel
On CISA’s list since
Apr 4, 2024 (federal fix deadline Apr 25, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Mar 26, 2024Microsoft SharePoint Server Code Injection VulnerabilityCVE-2023-24955 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.2
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
Product
SharePoint Server
On CISA’s list since
Mar 26, 2024 (federal fix deadline Apr 16, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 25, 2024Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · Nice · reported by MITREExploitedCritical 9.8
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
Product
Linear eMerge E3-Series
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2024Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
Product
Endpoint Manager Cloud Service Appliance (EPM CSA)
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2024Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2023-48788 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
Product
FortiClient EMS
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Mar 7, 2024JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2024-27198 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
Product
TeamCity
On CISA’s list since
Mar 7, 2024 (federal fix deadline Mar 28, 2024)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.