Updated 29 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

37 results

Sep 2, 2026SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityCVE-2026-83548 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedCritical 10
SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Product
SMA1000 Appliances
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Sep 2, 2026SonicWall SMA1000 Appliances OS Command Injection VulnerabilityCVE-2026-83549 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.8
SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Product
SMA1000 Appliances
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Aug 11, 2026Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCVE-2026-20349 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Product
Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
On CISA’s list since
Aug 11, 2026 (federal fix deadline Aug 14, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Jul 14, 2026SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityCVE-2026-15409 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 10
SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
Product
SMA1000 Appliances
On CISA’s list since
Jul 14, 2026 (federal fix deadline Jul 17, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Jul 14, 2026SonicWall SMA1000 Appliances Code Injection VulnerabilityCVE-2026-15410 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareHigh 7.2
SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
Product
SMA1000 Appliances
On CISA’s list since
Jul 14, 2026 (federal fix deadline Jul 17, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Apr 20, 2026Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Product
KACE Systems Management Appliance (SMA)
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seralys.com
Dec 17, 2025SonicWall SMA1000 Missing Authorization VulnerabilityCVE-2025-40602 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedMedium 6.6
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
Product
SMA1000 appliance
On CISA’s list since
Dec 17, 2025 (federal fix deadline Dec 24, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Sep 25, 2025Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityCVE-2025-20362 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.
Product
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
On CISA’s list since
Sep 25, 2025 (federal fix deadline Sep 26, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 25, 2025Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityCVE-2025-20333 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.9
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
Product
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
On CISA’s list since
Sep 25, 2025 (federal fix deadline Sep 26, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
May 1, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2023-44221 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.2
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Product
SMA100 Appliances
On CISA’s list since
May 1, 2025 (federal fix deadline May 22, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 16, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2021-20035 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedMedium 6.5
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Product
SMA100 Appliances
On CISA’s list since
Apr 16, 2025 (federal fix deadline May 7, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Jan 24, 2025SonicWall SMA1000 Appliances Deserialization VulnerabilityCVE-2025-23006 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
Product
SMA1000 Appliances
On CISA’s list since
Jan 24, 2025 (federal fix deadline Feb 14, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Nov 12, 2024Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) VulnerabilityCVE-2014-2120 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.1
Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com securityfocus.com
Oct 24, 2024Cisco ASA and FTD Denial-of-Service VulnerabilityCVE-2024-20481 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.8
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Oct 24, 2024 (federal fix deadline Nov 14, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 9, 2024Ivanti Cloud Services Appliance (CSA) OS Command Injection VulnerabilityCVE-2024-9380 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Oct 9, 2024Ivanti Cloud Services Appliance (CSA) SQL Injection VulnerabilityCVE-2024-9379 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedMedium 6.5
Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Oct 9, 2024 (federal fix deadline Oct 30, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Sep 19, 2024Ivanti Cloud Services Appliance (CSA) Path Traversal VulnerabilityCVE-2024-8963 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.4
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Sep 19, 2024 (federal fix deadline Oct 10, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Sep 13, 2024Ivanti Cloud Services Appliance OS Command Injection VulnerabilityCVE-2024-8190 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance
On CISA’s list since
Sep 13, 2024 (federal fix deadline Oct 4, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Apr 24, 2024Cisco ASA and FTD Privilege Escalation VulnerabilityCVE-2024-20359 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Apr 24, 2024 (federal fix deadline May 1, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 24, 2024Cisco ASA and FTD Denial of Service VulnerabilityCVE-2024-20353 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Apr 24, 2024 (federal fix deadline May 1, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Mar 25, 2024Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
Product
Endpoint Manager Cloud Service Appliance (EPM CSA)
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 15, 2024Cisco ASA and FTD Information Disclosure VulnerabilityCVE-2020-3259 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareHigh 7.5
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Feb 15, 2024 (federal fix deadline Mar 7, 2024)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Nov 16, 2023Sophos Web Appliance Command Injection VulnerabilityCVE-2023-1671 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
Product
Web Appliance
On CISA’s list since
Nov 16, 2023 (federal fix deadline Dec 7, 2023)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sophos.com
Sep 13, 2023Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access VulnerabilityCVE-2023-20269 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 5
Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.
Product
Adaptive Security Appliance and Firepower Threat Defense
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow VulnerabilityCVE-2016-6366 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
May 24, 2022Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityCVE-2016-6367 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.cisco.com tools.cisco.com
Mar 25, 2022WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCVE-2022-26318 · Network & remote access · WatchGuard · reported by MITREExploitedCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Product
Firebox and XTM Appliances
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog watchguard.com watchguard.com
Mar 25, 2022Quest KACE System Management Appliance Remote Command Execution VulnerabilityCVE-2018-11138 · Other software · Quest · reported by MITREExploitedRansomwareCritical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Product
KACE System Management Appliance
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Quest’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog coresecurity.com exploit-db.com
Jan 28, 2022SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilityCVE-2021-20038 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
Product
SMA 100 Appliances
On CISA’s list since
Jan 28, 2022 (federal fix deadline Feb 11, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com psirt.global.sonicwall.com
Nov 3, 2021Cisco ASA and FTD Read-Only Path Traversal VulnerabilityCVE-2020-3452 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Cisco ASA and FTD Cross-Site Scripting (XSS) VulnerabilityCVE-2020-3580 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 6.1
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Nov 3, 2021Cisco Adaptive Security Appliance (ASA) Denial-of-Service VulnerabilityCVE-2018-0296 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
Product
Adaptive Security Appliance (ASA)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityCVE-2020-8193 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8195 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8196 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 4.3
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCVE-2019-19781 · Network & remote access · Citrix · reported by MITREExploitedRansomwareCritical 9.8
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.