Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

23 results

Jul 15, 2026Oracle E-Business Suite Improper Privilege Management VulnerabilityCVE-2026-46817 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
Product
E-Business Suite
On CISA’s list since
Jul 15, 2026 (federal fix deadline Jul 18, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Oct 20, 2025Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityCVE-2025-61884 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareHigh 7.5
Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
Product
E-Business Suite
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com blogs.oracle.com
Oct 6, 2025Oracle E-Business Suite Unspecified VulnerabilityCVE-2025-61882 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
Product
E-Business Suite
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com blogs.oracle.com
Mar 3, 2025Hitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityCVE-2022-43769 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.8
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Mar 3, 2025Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityCVE-2022-43939 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.6
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Mar 3, 2025Cisco Small Business RV Series Routers Command Injection VulnerabilityCVE-2023-20118 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
Product
Small Business RV Series Routers
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Oct 10, 2023Microsoft Skype for Business Privilege Escalation VulnerabilityCVE-2023-41763 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.3
Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.
Product
Skype for Business
On CISA’s list since
Oct 10, 2023 (federal fix deadline Oct 31, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Sep 21, 2023Trend Micro Apex One and Worry-Free Business Security Remote Code Execution VulnerabilityCVE-2023-41179 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.2
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Product
Apex One and Worry-Free Business Security
On CISA’s list since
Sep 21, 2023 (federal fix deadline Oct 12, 2023)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
Feb 2, 2023Oracle E-Business Suite Unspecified VulnerabilityCVE-2022-21587 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Product
E-Business Suite
On CISA’s list since
Feb 2, 2023 (federal fix deadline Feb 23, 2023)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20708 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20703 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20701 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20700 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20699 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Mar 3, 2022Cisco Small Business Routers Improper Input Validation VulnerabilityCVE-2019-1652 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.2
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Product
Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 28, 2022Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityCVE-2017-5689 · Other software · Intel · reported by secure@intel.comExploitedCritical 9.8
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Product
Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Intel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Jan 18, 2022Oracle Business Intelligence Enterprise Edition Path TransversalCVE-2020-14864 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.5
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Product
Intelligence Enterprise Edition
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Nov 3, 2021Cisco Small Business RV320 and RV325 Routers Information Disclosure VulnerabilityCVE-2019-1653 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.
Product
Small Business RV320 and RV325 Routers
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Trend Micro Multiple Products Content Validation Escape VulnerabilityCVE-2020-8468 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Product
Apex One, OfficeScan and Worry-Free Business Security Agents
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36742 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36741 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.