Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

347new WordPress flaws this week

390,007entries in the database

142 results · page 1 of 3

Aug 11, 2026Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access tCVE-2026-66150 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.8
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Aug 11, 2026Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access tCVE-2026-66149 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.8
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Mar 31, 2026A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authentiCVE-2026-3470 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comLow 3.8
A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Mar 31, 2026A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacCVE-2026-3469 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comLow 2.7
A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Mar 31, 2026A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied CVE-2026-3468 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 4.8
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Nov 20, 2025A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted direcCVE-2025-40605 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Nov 20, 2025Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, alloCVE-2025-40604 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Sep 19, 2025Libraesva Email Security Gateway Command Injection VulnerabilityCVE-2025-59689 · Other software · Libraesva · reported by MITREExploitedMedium 6.1
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
Product
Email Security Gateway
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Libraesva’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.libraesva.com libraesva.com
Aug 21, 2025An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14.CVE-2024-45438 · Other software · reported by MITRECritical 9.1
An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.titanhq.com seclists.org
Mar 24, 2025Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.CVE-2024-9103 · Other software · Forcepoint · reported by psirt@forcepoint.comMedium 6.1
Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.forcepoint.com
Nov 18, 2024A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) couldCVE-2020-3548 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to inefficient processing of incoming TLS traffic. An attacker could exploit this vulnerability by sending a series of crafted TLS packets to an affected device. A successful exploit could allow the attacker to trigger a prolonged state of high CPU utilization. The affected device would still be operative, but response time and overall performance may be degraded.There are no workarounds that address this vulnerability.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Sep 4, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) alloCVE-2024-2166 · Other software · Forcepoint · reported by psirt@forcepoint.comHigh 8.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.forcepoint.com
Mar 14, 2024An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attackeCVE-2024-22398 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 4.9
An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com psirt.global.sonicwall.com
Jan 10, 2024Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email GatewaCVE-2023-31488 · Network & remote access · Cisco · reported by MITRECritical 9.8
Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.
Product
Ironport Email Security Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bst.cisco.com bst.cisco.com
Aug 4, 2023A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2020-26082 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass content filters that are configured on an affected device. The vulnerability is due to improper handling of password-protected zip files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted zip-compressed file to an affected device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
May 24, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
Feb 13, 2023SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive informatioCVE-2023-0655 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 5.3
SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
Product
SonicWall Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com psirt.global.sonicwall.com
Jan 20, 2023A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackeCVE-2023-20057 · Network & remote access · Cisco · reported by psirt@cisco.comNone
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service (CVE-2022-20960 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an affected device. An attacker could exploit this vulnerability by establishing a large number of concurrent TLS connections to an affected device. A successful exploit could allow the attacker to cause the device to drop new TLS email messages that come from the associated email servers. Exploitation of this vulnerability does not cause the affected device to unexpectedly reload. The device will recover autonomously within a few hours of when the attack is halted or mitigated.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web AppliancCVE-2022-20942 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to weak enforcement of back-end authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain confidential data that is stored on the affected device.
Product
Cisco Secure Web Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance couldCVE-2022-20868 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. This vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account.
Product
Cisco Secure Web Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated, CVE-2022-20867 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct SQL injection attacks as root on an affected system. The attacker must have the credentials of a high-privileged user account. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Nov 4, 2022A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTCVE-2022-20772 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses.
Product
Cisco Secure Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jul 29, 2022Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance.CVE-2022-2324 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions
Product
SonicWall Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com psirt.global.sonicwall.com
Jun 15, 2022A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA),CVE-2022-20798 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass authentication and log in to the web management interface of an affected device. This vulnerability is due to improper authentication checks when an affected device uses Lightweight Directory Access Protocol (LDAP) for external authentication. An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device. A successful exploit could allow the attacker to gain unauthorized access to the web-based management interface of the affected device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jun 15, 2022A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email SecurCVE-2022-20664 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.7
A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Security Appliance (ESA) could allow an authenticated, remote attacker to retrieve sensitive information from a Lightweight Directory Access Protocol (LDAP) external authentication server connected to an affected device. This vulnerability is due to a lack of proper input sanitization while querying the external authentication server. An attacker could exploit this vulnerability by sending a crafted query through an external authentication web page. A successful exploit could allow the attacker to gain access to sensitive information, including user credentials from the external authentication server. To exploit this vulnerability, an attacker would need valid operator-level (or higher) credentials.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Apr 6, 2022A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, formerlCVE-2022-20675 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, formerly Security Management Appliance, could allow an unauthenticated, remote attacker to crash the Simple Network Management Protocol (SNMP) service, resulting in a denial of service (DoS) condition. This vulnerability is due to an open port listener on TCP port 199. An attacker could exploit this vulnerability by connecting to TCP port 199. A successful exploit could allow the attacker to crash the SNMP service, resulting in a DoS condition.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Mar 15, 2022Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF.CVE-2020-36519 · Other software · Mimecast · reported by MITREMedium 4.9
Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.)
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wesleyk.me wesleyk.me
Feb 17, 2022A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security ApplianCVE-2022-20653 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in DNS name resolution by the affected software. An attacker could exploit this vulnerability by sending specially formatted email messages that are processed by an affected device. A successful exploit could allow the attacker to cause the device to become unreachable from management interfaces or to process additional email messages for a period of time until the device recovers, resulting in a DoS condition. Continued attacks could cause the device to become completely unavailable, resulting in a persistent DoS condition.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Nov 4, 2021A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackCVE-2021-34741 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 6, 2021A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote CVE-2021-1534 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jun 16, 2021A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco WebCVE-2021-1566 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
May 13, 2021SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup.CVE-2021-20025 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.8
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall.
Product
Email Security Virtual Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com psirt.global.sonicwall.com
May 6, 2021A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security ApplCVE-2021-1516 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Apr 20, 2021SonicWall Email Security Path Traversal VulnerabilityCVE-2021-20023 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareMedium 4.9
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 9, 2021SonicWall Email Security Unrestricted Upload of File VulnerabilityCVE-2021-20022 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareHigh 7.2
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Apr 9, 2021SonicWall Email Security Improper Privilege Management VulnerabilityCVE-2021-20021 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Jan 20, 2021A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management AppCVE-2021-1129 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to access general system information and certain configuration information from an affected device. The vulnerability exists because a secure authentication token is not required when authenticating to the general purpose API. An attacker could exploit this vulnerability by sending a crafted request for information to the general purpose API on an affected device. A successful exploit could allow the attacker to obtain system and configuration information from the affected device, resulting in an unauthorized information disclosure.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Oct 8, 2020A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote CVE-2020-3568 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 22, 2020A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a crossCVE-2020-3137 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 22, 2020A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attackerCVE-2020-3133 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass the configured content filters, which could allow malicious content to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 22, 2020A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management CVE-2019-1983 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause repeated crashes in some internal processes that are running on the affected devices, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an email message with a crafted attachment through an affected device. A successful exploit could allow the attacker to cause specific processes to crash repeatedly, resulting in the complete unavailability of both the Cisco Advanced Malware Protection (AMP) and message tracking features and in severe performance degradation while processing email. After the affected processes restart, the software resumes filtering for the same attachment, causing the affected processes to crash and restart again. A successful exploit could also allow the attacker to cause a repeated DoS condition. Manual intervention may be required to recover from this situation.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 22, 2020A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remoteCVE-2019-1947 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 3, 2020A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management ApplCVE-2020-3547 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 3, 2020A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote CVE-2020-3546 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Aug 17, 2020A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) couCVE-2020-3447 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data, which may include user credentials. To exploit this vulnerability, the attacker would need to have valid credentials at the operator level or higher on the affected device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jul 16, 2020A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to bypass URL filtering onCVE-2020-3370 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to bypass URL filtering on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted, malicious HTTP request to an affected device. A successful exploit could allow the attacker to redirect users to malicious sites.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jun 17, 2020A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote CVE-2020-3368 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting the URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Mar 4, 2020A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances CVE-2020-3181 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated remote attacker to exhaust resources on an affected device. The vulnerability is due to insufficient control over system memory allocation. An attacker could exploit this vulnerability by sending a crafted email through the targeted device. A successful exploit could allow the attacker to cause an email attachment that contains malware to be delivered to a user and cause email processing delays.
Product
Cisco Email Security Appliance (ESA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Mar 4, 2020A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco CCVE-2020-3164 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific HTTP request headers. An attacker could exploit this vulnerability by sending a malformed HTTP request to an affected device. A successful exploit could allow the attacker to trigger a prolonged status of high CPU utilization relative to the GUI process(es). Upon successful exploitation of this vulnerability, an affected device will still be operative, but its response time and overall performance may be degraded.
Product
Cisco Web Security Appliance (WSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.