Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

14 results

Oct 20, 2026Siemens Software Center Uncontrolled Search Path Element VulnerabilityCVE-2026-110936 · Other software · Siemens · reported by productcert@siemens.comExploitedHigh 8.4
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Product
Software Center
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert-portal.siemens.com productcert.siemens.com
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-Link · reported by f23511db-6c3e-4e32-a477-6aa17d310630ExploitedHigh 8.6
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Jul 17, 2023Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2023-36884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
Product
Windows
On CISA’s list since
Jul 17, 2023 (federal fix deadline Aug 29, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
May 1, 2023TP-Link Archer AX-21 Command Injection VulnerabilityCVE-2023-1389 · Network & remote access · TP-Link · reported by vulnreport@tenable.comExploitedHigh 8.8
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
Product
Archer AX21
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
Feb 2, 2023Multiple SugarCRM Products Remote Code Execution VulnerabilityCVE-2023-22952 · Other software · SugarCRM · reported by MITREExploitedHigh 8.8
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Product
Multiple Products
On CISA’s list since
Feb 2, 2023 (federal fix deadline Feb 23, 2023)
What to do
Attackers are using this now. Install SugarCRM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.sugarcrm.com
Oct 24, 2022Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCVE-2020-3153 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 6.5
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
Product
AnyConnect Secure
On CISA’s list since
Oct 24, 2022 (federal fix deadline Nov 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 25, 2022PEAR Archive_Tar Improper Link Resolution VulnerabilityCVE-2020-36193 · Other software · PEAR · reported by MITREExploitedHigh 7.5
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
Product
Archive_Tar
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com lists.debian.org
Aug 25, 2022PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityCVE-2020-28949 · Other software · PEAR · reported by MITREExploitedHigh 7.8
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
Product
Archive_Tar
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
May 24, 2022Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2017-8543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Arcserve Unified Data Protection (UDP) Directory Traversal VulnerabilityCVE-2015-4068 · Other software · Arcserve · reported by MITREExploitedCritical 9.1
Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.
Product
Unified Data Protection (UDP)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Arcserve’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.arcserve.com securityfocus.com
Mar 25, 2022TP-Link Multiple Archer Devices Directory Traversal VulnerabilityCVE-2015-3035 · Network & remote access · TP-Link · reported by MITREExploitedHigh 7.5
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Product
Multiple Archer Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Mar 25, 2022Elasticsearch Groovy Scripting Engine Remote Code Execution VulnerabilityCVE-2015-1427 · Other software · Elastic · reported by MITREExploitedCritical 9.8
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
Product
Elasticsearch
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Elastic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Elasticsearch Remote Code Execution VulnerabilityCVE-2014-3120 · Other software · Elastic · reported by MITREExploitedHigh 8.1
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
Product
Elasticsearch
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Elastic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bouk.co exploit-db.com
Nov 3, 2021Arcadyan Buffalo Firmware Path Traversal VulnerabilityCVE-2021-20090 · Network & remote access · Arcadyan · reported by vulnreport@tenable.comExploitedCritical 9.8
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Product
Buffalo Firmware
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arcadyan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.cert.org secpod.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.