Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

23 results

Apr 17, 2025Apple Multiple Products Arbitrary Read and Write VulnerabilityCVE-2025-31201 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedCritical 9.8
Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Product
Multiple Products
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 4, 2025VMware ESXi Arbitrary Write VulnerabilityCVE-2025-22225 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 8.2
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
Product
ESXi
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Oct 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-41352 · Email & office · Synacor · reported by MITREExploitedRansomwareCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 20, 2022 (federal fix deadline Nov 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.zimbra.org
Aug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-27925 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.2
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Mar 28, 2022Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityCVE-2021-26085 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareMedium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Product
Confluence Server
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com
Mar 28, 2022Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityCVE-2013-2729 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
Product
Reader and Acrobat
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 25, 2022WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCVE-2022-26318 · Network & remote access · WatchGuard · reported by MITREExploitedCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Product
Firebox and XTM Appliances
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog watchguard.com watchguard.com
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2016-4117 · Other software · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2016-1019 · Other software · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com lists.opensuse.org
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2015-7645 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com lists.opensuse.org
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-4681 · Other software · Oracle · reported by MITREExploitedRansomwareCritical 9.8
The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com immunityproducts.blogspot.com
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-1723 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mail.openjdk.java.net marc.info
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2012-1535 · Other software · Adobe · reported by MITREExploitedHigh 7.8
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-0507 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com krebsonsecurity.com
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2011-3544 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Product
Java SE JDK and JRE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org marc.info
Mar 3, 2022Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityCVE-2010-0188 · Email & office · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org secunia.com
Jan 28, 2022GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-6271 · Other software · GNU · reported by security@debian.orgExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
Product
Bourne-Again Shell (Bash)
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org archives.neohapsis.com
Jan 28, 2022GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-7169 · Other software · GNU · reported by MITREExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
Product
Bourne-Again Shell (Bash)
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org archives.neohapsis.com
Jan 10, 2022Kibana Arbitrary Code ExecutionCVE-2019-7609 · Other software · Elastic · reported by security@elastic.coExploitedCritical 10
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Product
Kibana
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Elastic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com access.redhat.com
Dec 10, 2021Fortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedLow 3.3
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Product
FortiOS
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Nov 3, 2021ImageMagick Arbitrary File Deletion VulnerabilityCVE-2016-3715 · Other software · ImageMagick · reported by Red HatExploitedMedium 5.5
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
Product
ImageMagick
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install ImageMagick’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.imagemagick.org lists.opensuse.org
Nov 3, 2021Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityCVE-2019-11510 · Network & remote access · Ivanti · reported by MITREExploitedRansomwareCritical 10
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
Product
Pulse Connect Secure
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.