Vulnerability database

7 results

• Apr 20, 2026Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10

  Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

  Product

  KACE Systems Management Appliance (SMA)

  On CISA’s list since

  Apr 20, 2026 (federal fix deadline May 4, 2026)

  What to do

  Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogseclists.orgseralys.com

• Apr 13, 2026Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2026-21643 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8

  Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

  Product

  FortiClient EMS

  On CISA’s list since

  Apr 13, 2026 (federal fix deadline Apr 16, 2026)

  What to do

  Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfortiguard.fortinet.comgithub.com

• Apr 6, 2026Fortinet FortiClient EMS Improper Access Control VulnerabilityCVE-2026-35616 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8

  Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

  Product

  FortiClient EMS

  On CISA’s list since

  Apr 6, 2026 (federal fix deadline Apr 9, 2026)

  What to do

  Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfortiguard.fortinet.comcisa.gov

• Feb 24, 2026Soliton Systems K.K FileZen OS Command Injection VulnerabilityCVE-2026-25108 · Other software · Soliton Systems K.K · reported by vultures@jpcert.or.jpExploitedHigh 8.7

  Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.

  Product

  FileZen

  On CISA’s list since

  Feb 24, 2026 (federal fix deadline Mar 17, 2026)

  What to do

  Attackers are using this now. Install Soliton Systems K.K’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogjvn.jpsoliton.co.jp

• Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim Systems · reported by MITREExploitedHigh 8.1

  Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.

  Product

  USAHERDS

  On CISA’s list since

  Dec 23, 2024 (federal fix deadline Jan 13, 2025)

  What to do

  Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comacclaimsystems.com

• Mar 25, 2024Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2023-48788 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8

  Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

  Product

  FortiClient EMS

  On CISA’s list since

  Mar 25, 2024 (federal fix deadline Apr 15, 2024)

  What to do

  Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfortiguard.comfortiguard.com

• Mar 25, 2022QNAP Helpdesk Improper Access Control VulnerabilityCVE-2020-2506 · Network & remote access · QNAP Systems · reported by security@qnapsecurity.com.twExploitedHigh 7.3

  QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.

  Product

  Helpdesk

  On CISA’s list since

  Mar 25, 2022 (federal fix deadline Apr 15, 2022)

  What to do

  Attackers are using this now. Install QNAP Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogqnap.comqnap.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.