Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

129 results · page 1 of 3

Oct 23, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-110447 · Other software · Collabora · reported by MITREExploitedCritical 9.2
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Product
Collabora Online – Built-in CODE Server
On CISA’s list since
Oct 23, 2026 (federal fix deadline Oct 26, 2026)
What to do
Attackers are using this now. Install Collabora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com help.nextcloud.com
Oct 20, 2026EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCVE-2026-106931 · Other software · EG Secure Solutions · reported by vultures@jpcert.or.jpExploitedHigh 8.5
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Product
SiteGuard Server Edition
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install EG Secure Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp eg-secure.co.jp
Oct 14, 2026Ahsay AhsayCBS Command Injection VulnerabilityCVE-2026-105134 · Other software · Ahsay · reported by VulDBExploitedCritical 10
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Product
AhsayCBS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Ahsay’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vuldb.com vuldb.com
Oct 13, 2026Microsoft Windows Command Injection VulnerabilityCVE-2026-96951 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 8, 2026Apache Struts Command Injection VulnerabilityCVE-2016-3081 · Websites & servers · Apache · reported by Red HatExploitedHigh 8.1
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Product
Struts
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com huawei.com
Sep 10, 2026MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCVE-2026-86060 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedCritical 9.2
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
Product
RouterOS
On CISA’s list since
Sep 10, 2026 (federal fix deadline Sep 13, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 2, 2026SonicWall SMA1000 Appliances OS Command Injection VulnerabilityCVE-2026-83549 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.8
SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Product
SMA1000 Appliances
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Sep 2, 2026Kestra OSS OS Command Injection VulnerabilityCVE-2026-49869 · Other software · Kestra · reported by GitHubExploitedCritical 10
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
Product
Kestra OSS
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install Kestra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 21, 2026Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilityCVE-2026-73570 · Email & office · Synacor · reported by MITREExploitedHigh 8.9
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 21, 2026 (federal fix deadline Aug 24, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Aug 7, 2026Progress LoadMaster Command Injection VulnerabilityCVE-2026-8037 · Other software · Progress · reported by security@progress.comExploitedCritical 9.6
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Product
LoadMaster
On CISA’s list since
Aug 7, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.progress.com labs.watchtowr.com
Jul 27, 2026Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityCVE-2026-16812 · Other software · Arista · reported by psirt@arista.comExploitedCritical 10
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Product
VeloCloud Orchestrator
On CISA’s list since
Jul 27, 2026 (federal fix deadline Jul 30, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com cisa.gov
Jul 16, 2026Fortinet FortiSandbox OS Command Injection VulnerabilityCVE-2026-39808 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Product
FortiSandbox
On CISA’s list since
Jul 16, 2026 (federal fix deadline Jul 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com github.com
Jul 16, 2026Fortinet FortiSandbox OS Command Injection VulnerabilityCVE-2026-25089 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
Product
FortiSandbox
On CISA’s list since
Jul 16, 2026 (federal fix deadline Jul 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Jun 11, 2026Ivanti Sentry OS Command Injection VulnerabilityCVE-2026-10520 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 10
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
Product
Sentry
On CISA’s list since
Jun 11, 2026 (federal fix deadline Jun 14, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com github.com
Jun 8, 2026BerriAI LiteLLM Command Injection VulnerabilityCVE-2026-42271 · Other software · BerriAI · reported by GitHubExploitedHigh 8.7
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
Product
LiteLLM
On CISA’s list since
Jun 8, 2026 (federal fix deadline Jun 22, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 24, 2026D-Link DIR-823X Command Injection VulnerabilityCVE-2025-29635 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.2
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DIR-823X
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com akamai.com
Mar 3, 2026Broadcom VMware Aria Operations Command Injection VulnerabilityCVE-2026-22719 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 8.1
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
Product
VMware Aria Operations
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog knowledge.broadcom.com support.broadcom.com
Feb 24, 2026Soliton Systems K.K FileZen OS Command Injection VulnerabilityCVE-2026-25108 · Other software · Soliton Systems K.K · reported by vultures@jpcert.or.jpExploitedHigh 8.7
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
Product
FileZen
On CISA’s list since
Feb 24, 2026 (federal fix deadline Mar 17, 2026)
What to do
Attackers are using this now. Install Soliton Systems K.K’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp soliton.co.jp
Feb 13, 2026BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCVE-2026-1731 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedRansomwareCritical 9.9
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Product
Remote Support (RS) and Privileged Remote Access (PRA)
On CISA’s list since
Feb 13, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com beyondtrust.com
Feb 5, 2026React Native Community CLI OS Command Injection VulnerabilityCVE-2025-11953 · Other software · React Native Community · reported by reefs@jfrog.comExploitedCritical 9.8
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Product
CLI
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install React Native Community’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com jfrog.com
Feb 3, 2026Sangoma FreePBX OS Command Injection VulnerabilityCVE-2025-64328 · Other software · Sangoma · reported by GitHubExploitedHigh 8.6
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.
Product
FreePBX
On CISA’s list since
Feb 3, 2026 (federal fix deadline Feb 24, 2026)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Dec 8, 2025Array Networks ArrayOS AG OS Command Injection VulnerabilityCVE-2025-66644 · Network & remote access · Array Networks · reported by MITREExploitedHigh 7.2
Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
Product
ArrayOS AG
On CISA’s list since
Dec 8, 2025 (federal fix deadline Dec 29, 2025)
What to do
Attackers are using this now. Install Array Networks ’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bleepingcomputer.com jpcert.or.jp
Nov 18, 2025Fortinet FortiWeb OS Command Injection VulnerabilityCVE-2025-58034 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedHigh 7.2
Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
Product
FortiWeb
On CISA’s list since
Nov 18, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Nov 4, 2025CWP Control Web Panel OS Command Injection VulnerabilityCVE-2025-48703 · Other software · CWP · reported by MITREExploitedCritical 9
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Product
Control Web Panel
On CISA’s list since
Nov 4, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fenrisk.com control-webpanel.com
Oct 2, 2025GNU Bash OS Command Injection VulnerabilityCVE-2014-6278 · Other software · GNU · reported by security@debian.orgExploitedHigh 8.8
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
Product
GNU Bash
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp jvndb.jvn.jp
Oct 2, 2025Smartbedded Meteobridge Command Injection VulnerabilityCVE-2025-4008 · Other software · Smartbedded · reported by research@onekey.comExploitedHigh 8.7
Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.
Product
Meteobridge
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Smartbedded’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.meteohub.de onekey.com
Sep 29, 2025Libraesva Email Security Gateway Command Injection VulnerabilityCVE-2025-59689 · Other software · Libraesva · reported by MITREExploitedMedium 6.1
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
Product
Email Security Gateway
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Libraesva’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.libraesva.com libraesva.com
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-Link · reported by f23511db-6c3e-4e32-a477-6aa17d310630ExploitedHigh 8.6
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Aug 18, 2025Trend Micro Apex One OS Command Injection VulnerabilityCVE-2025-54948 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.4
Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Product
Apex One
On CISA’s list since
Aug 18, 2025 (federal fix deadline Sep 8, 2025)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com cisa.gov
Aug 13, 2025N-able N-Central Command Injection VulnerabilityCVE-2025-8876 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bExploitedCritical 9.4
N-able N-Central contains a command injection vulnerability via improper sanitization of user input.
Product
N-Central
On CISA’s list since
Aug 13, 2025 (federal fix deadline Aug 20, 2025)
What to do
Attackers are using this now. Install N-able’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.n-able.com cisa.gov
Aug 5, 2025D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityCVE-2020-25079 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DCS-2530L and DCS-2670L Devices
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com twitter.com
Jul 7, 2025PHPMailer Command Injection VulnerabilityCVE-2016-10033 · Websites & servers · PHP · reported by MITREExploitedCritical 9.8
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Product
PHPMailer
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install PHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 16, 2025TP-Link Multiple Routers Command Injection VulnerabilityCVE-2023-33538 · Network & remote access · TP-Link · reported by MITREExploitedHigh 8.8
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Jun 16, 2025 (federal fix deadline Jul 7, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com web.archive.org
Jun 2, 2025ASUS RT-AX55 Routers OS Command Injection VulnerabilityCVE-2023-39780 · Network & remote access · ASUS · reported by MITREExploitedHigh 8.8
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346.
Product
RT-AX55 Routers
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install ASUS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 15, 2025DrayTek Vigor Routers OS Command Injection VulnerabilityCVE-2024-12987 · Network & remote access · DrayTek · reported by VulDBExploitedMedium 6.9
DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
Product
Vigor Routers
On CISA’s list since
May 15, 2025 (federal fix deadline Jun 5, 2025)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog netsecfish.notion.site vuldb.com
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-6047 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 7, 2025GeoVision Devices OS Command Injection VulnerabilityCVE-2024-11120 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
May 2, 2025Commvault Command Center Path Traversal VulnerabilityCVE-2025-34028 · Other software · Commvault · reported by VulnCheckExploitedCritical 9.3
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Product
Command Center
On CISA’s list since
May 2, 2025 (federal fix deadline May 23, 2025)
What to do
Attackers are using this now. Install Commvault’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.commvault.com github.com
May 1, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2023-44221 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedHigh 7.2
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Product
SMA100 Appliances
On CISA’s list since
May 1, 2025 (federal fix deadline May 22, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 16, 2025SonicWall SMA100 Appliances OS Command Injection VulnerabilityCVE-2021-20035 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedMedium 6.5
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Product
SMA100 Appliances
On CISA’s list since
Apr 16, 2025 (federal fix deadline May 7, 2025)
What to do
Attackers are using this now. Install SonicWall’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Mar 19, 2025Edimax IC-7100 IP Camera OS Command Injection VulnerabilityCVE-2025-1316 · Other software · Edimax · reported by ics-cert@hq.dhs.govExploitedCritical 9.3
Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
IC-7100 IP Camera
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install Edimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cisa.gov cisa.gov
Mar 3, 2025Cisco Small Business RV Series Routers Command Injection VulnerabilityCVE-2023-20118 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.
Product
Small Business RV Series Routers
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40890 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 11, 2025Zyxel DSL CPE OS Command Injection VulnerabilityCVE-2024-40891 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
Product
DSL CPE Devices
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Feb 4, 2025Paessler PRTG Network Monitor OS Command Injection VulnerabilityCVE-2018-9276 · Other software · Paessler · reported by MITREExploitedHigh 7.2
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
Product
PRTG Network Monitor
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Paessler’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Product
Controllers
On CISA’s list since
Jan 16, 2025 (federal fix deadline Feb 6, 2025)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.aviatrix.com docs.aviatrix.com
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 18, 2024Reolink RLC-410W IP Camera OS Command Injection Vulnerability CVE-2021-40407 · Other software · Reolink · reported by talos-cna@cisco.comExploitedHigh 7.2
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
Product
RLC-410W IP Camera
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog talosintelligence.com talosintelligence.com
Dec 18, 2024Reolink Multiple IP Cameras OS Command Injection VulnerabilityCVE-2019-11001 · Other software · Reolink · reported by MITREExploitedHigh 7.2
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
Product
Multiple IP Cameras
On CISA’s list since
Dec 18, 2024 (federal fix deadline Jan 8, 2025)
What to do
Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com vdoo.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.