Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Oct 28, 2026Linux Kernel Missing Initialization of a Variable VulnerabilityCVE-2026-46300 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
- Product
- Kernel
- On CISA’s list since
- Oct 28, 2026 (federal fix deadline Oct 31, 2026)
- What to do
- Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggit.kernel.orggit.kernel.org
Mar 3, 2026Broadcom VMware Aria Operations Command Injection VulnerabilityCVE-2026-22719 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 8.1
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
- Product
- VMware Aria Operations
- On CISA’s list since
- Mar 3, 2026 (federal fix deadline Mar 24, 2026)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogknowledge.broadcom.comsupport.broadcom.com
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 7.8
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- Product
- VMware Aria Operations and VMware Tools
- On CISA’s list since
- Oct 30, 2025 (federal fix deadline Nov 20, 2025)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comopenwall.com
Nov 13, 2023Juniper Junos OS EX Series PHP External Variable Modification VulnerabilityCVE-2023-36844 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
- Product
- Junos OS
- On CISA’s list since
- Nov 13, 2023 (federal fix deadline Nov 17, 2023)
- What to do
- Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsupportportal.juniper.net
Nov 13, 2023Juniper Junos OS EX Series and SRX Series PHP External Variable Modification VulnerabilityCVE-2023-36845 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedCritical 9.8
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
- Product
- Junos OS
- On CISA’s list since
- Nov 13, 2023 (federal fix deadline Nov 17, 2023)
- What to do
- Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jun 22, 2023Vmware Aria Operations for Networks Command Injection VulnerabilityCVE-2023-20887 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
- Product
- Aria Operations for Networks
- On CISA’s list since
- Jun 22, 2023 (federal fix deadline Jul 13, 2023)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comvmware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.