Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

818 results · page 9 of 17

Jun 8, 2022Google Chromium V8 Remote Code Execution VulnerabilityCVE-2018-17463 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Jun 8, 2022Adobe Acrobat and Reader Double Free VulnerabilityCVE-2018-4990 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Jun 8, 2022Google Chromium V8 Out-of-Bounds Read VulnerabilityCVE-2016-1646 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog googlechromereleases.blogspot.com lists.opensuse.org
Jun 8, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2012-4969 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.1
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.vulnhunt.com dev.metasploit.com
Jun 8, 2022Microsoft Windows Authenticode Signature Verification Remote Code Execution VulnerabilityCVE-2012-0151 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.
Product
Windows
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Jun 8, 2022Adobe Reader and Acrobat Universal 3D Memory Corruption VulnerabilityCVE-2011-2462 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
Product
Reader and Acrobat
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Jun 8, 2022Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityCVE-2010-2883 · Email & office · Adobe · reported by AdobeExploitedHigh 7.3
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.metasploit.com community.websense.com
Jun 8, 2022Adobe Acrobat and Reader Use-After-Free VulnerabilityCVE-2009-4324 · Email & office · Adobe · reported by AdobeExploitedHigh 7.8
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com contagiodump.blogspot.com
Jun 8, 2022Adobe Acrobat and Reader Universal 3D Remote Code Execution VulnerabilityCVE-2009-3953 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org osvdb.org
Jun 8, 2022Adobe Acrobat and Reader, Flash Player Unspecified VulnerabilityCVE-2009-1862 · Email & office · Adobe · reported by MITREExploitedHigh 7.8
Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Acrobat and Reader, Flash Player
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com bugs.adobe.com
Jun 8, 2022Adobe Acrobat and Reader Unspecified VulnerabilityCVE-2008-0655 · Email & office · Adobe · reported by MITREExploitedHigh 8.8
Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com kb.adobe.com
Jun 8, 2022Adobe Acrobat and Reader Buffer Overflow VulnerabilityCVE-2007-5659 · Email & office · Adobe · reported by MITREExploitedHigh 7.8
Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
Product
Acrobat and Reader
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.idefense.com secunia.com
Jun 2, 2022Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityCVE-2022-26134 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Product
Confluence Server/Data Center
On CISA’s list since
Jun 2, 2022 (federal fix deadline Jun 6, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 25, 2022Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution VulnerabilityCVE-2016-3393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Windows Open Type Font Remote Code Execution VulnerabilityCVE-2016-7256 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Adobe Flash Player and AIR Use-After-Free VulnerabilityCVE-2016-0984 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
Product
Flash Player and AIR
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
May 25, 2022Microsoft Silverlight Runtime Remote Code Execution VulnerabilityCVE-2016-0034 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
May 25, 2022Microsoft Windows TS WebProxy Directory Traversal VulnerabilityCVE-2015-0016 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com packetstormsecurity.com
May 25, 2022Microsoft Internet Explorer ASLR Bypass VulnerabilityCVE-2015-0071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2425 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
May 25, 2022Mozilla Firefox Security Feature Bypass VulnerabilityCVE-2015-4495 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 8.8
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
Product
Firefox
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
May 25, 2022Microsoft Windows Remote Code Execution VulnerabilityCVE-2015-1671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Windows Remote Code Execution VulnerabilityCVE-2014-4148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
May 25, 2022Adobe Flash Player Dereferenced Pointer VulnerabilityCVE-2014-8439 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.
Product
Flash Player
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-4123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
May 25, 2022Adobe Reader and Acrobat Sandbox Bypass VulnerabilityCVE-2014-0546 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.
Product
Reader and Acrobat
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-2817 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2013-7331 · Computers, phones & browsers · Microsoft · reported by MITREExploitedMedium 6.5
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fireeye.com kb.cert.org
May 25, 2022IBM InfoSphere BigInsights Invalid Input VulnerabilityCVE-2013-3993 · Other software · IBM · reported by psirt@us.ibm.comExploitedRansomwareMedium 6.5
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Product
InfoSphere BigInsights
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install IBM’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com www-01.ibm.com
May 25, 2022Microsoft Silverlight Information Disclosure VulnerabilityCVE-2013-3896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Oracle JRE Unspecified VulnerabilityCVE-2013-2423 · Other software · Oracle · reported by secalert_us@oracle.comExploitedLow 3.7
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fuseyism.com blog.spiderlabs.com
May 25, 2022Oracle JRE Sandbox Bypass VulnerabilityCVE-2013-0431 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareLow 3.7
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blogs.computerworld.com
May 25, 2022Oracle JRE Remote Code Execution VulnerabilityCVE-2013-0422 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blog.fuseyism.com
May 25, 2022Microsoft Silverlight Double Dereference VulnerabilityCVE-2013-0074 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Oracle Fusion Middleware Unspecified VulnerabilityCVE-2012-1710 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.
Product
Fusion Middleware
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mandriva.com oracle.com
May 25, 2022Red Hat JBoss Information Disclosure VulnerabilityCVE-2010-1428 · Other software · Red Hat · reported by Red HatExploitedRansomwareHigh 7.5
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
May 25, 2022Oracle JRE Unspecified VulnerabilityCVE-2010-0840 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog itrc.hp.com lists.apple.com
May 25, 2022Red Hat JBoss Authentication Bypass VulnerabilityCVE-2010-0738 · Other software · Red Hat · reported by Red HatExploitedRansomwareMedium 5.3
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info public.support.unisys.com
May 24, 2022Apple iOS Information Disclosure VulnerabilityCVE-2016-4655 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com lists.apple.com
May 24, 2022Microsoft Windows SMBv1 Information Disclosure VulnerabilityCVE-2017-0147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Product
SMBv1 server
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 24, 2022Microsoft XML Core Services Information Disclosure VulnerabilityCVE-2017-0022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
Product
XML Core Services
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2017-0149 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2017-0210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2017-8543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2016-0162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityCVE-2016-3351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer and Edge
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityCVE-2016-6367 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 24, 2022Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityCVE-2016-3298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Android Kernel Use-After-Free VulnerabilityCVE-2021-1048 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8
Android kernel contains a use-after-free vulnerability that allows for privilege escalation.
Product
Kernel
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
May 23, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2019-0676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.