Vulnerability database

4 results

• Apr 20, 2026Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCVE-2026-20128 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5

  Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

  Product

  Catalyst SD-WAN Manager

  On CISA’s list since

  Apr 20, 2026 (federal fix deadline Apr 23, 2026)

  What to do

  Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov

• Feb 18, 2026Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCVE-2026-22769 · Other software · Dell · reported by security_alert@emc.comExploitedCritical 10

  Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.

  Product

  RecoverPoint for Virtual Machines (RP4VMs)

  On CISA’s list since

  Feb 18, 2026 (federal fix deadline Feb 21, 2026)

  What to do

  Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogdell.comcloud.google.com

• Feb 6, 2025Dante Discovery Process Control VulnerabilityCVE-2022-23748 · Other software · Audinate · reported by cve@checkpoint.comExploitedHigh 7.8

  Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.

  Product

  Dante Discovery

  On CISA’s list since

  Feb 6, 2025 (federal fix deadline Feb 27, 2025)

  What to do

  Attackers are using this now. Install Audinate’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcpr-zero.checkpoint.comaudinate.com

• Nov 3, 2021Cisco IOS XR Software Discovery Protocol Format String VulnerabilityCVE-2020-3118 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8

  Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device.

  Product

  IOS XR

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comtools.cisco.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.