Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

557new WordPress flaws this week

391,528entries in the database

22 results

Oct 30, 2026Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityCVE-2026-111357 · Network & remote access · Ivanti · reported by MITREExploitedHigh 7
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
Product
Connect Secure
On CISA’s list since
Oct 30, 2026 (federal fix deadline Nov 2, 2026)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog hub.ivanti.com volexity.com
Sep 10, 2026MikroTik RouterOS Missing Authentication for Critical Function VulnerabilityCVE-2026-67277 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedHigh 8.8
MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
Product
RouterOS
On CISA’s list since
Sep 10, 2026 (federal fix deadline Sep 13, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Aug 31, 2026PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityCVE-2026-81578 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4ExploitedHigh 8.8
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
Product
NG/MF
On CISA’s list since
Aug 31, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog papercut.com github.com
Aug 20, 2026TrueConf Server Missing Authentication for Critical Function VulnerabilityCVE-2026-72529 · Other software · TrueConf · reported by vulnerability@kaspersky.comExploitedCritical 9.3
TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.
Product
Server
On CISA’s list since
Aug 20, 2026 (federal fix deadline Aug 23, 2026)
What to do
Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ics-cert.kaspersky.com securelist.com
Jul 14, 2026Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityCVE-2026-56164 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 5.3
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
Product
SharePoint Server
On CISA’s list since
Jul 14, 2026 (federal fix deadline Jul 17, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jun 18, 2026Splunk Enterprise Missing Authentication for Critical Function VulnerabilityCVE-2026-20253 · Other software · Splunk · reported by psirt@cisco.comExploitedCritical 9.8
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.
Product
Enterprise
On CISA’s list since
Jun 18, 2026 (federal fix deadline Jun 21, 2026)
What to do
Attackers are using this now. Install Splunk’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisory.splunk.com labs.watchtowr.com
Jun 12, 2026Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityCVE-2026-35273 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
Product
PeopleSoft Enterprise PeopleTools
On CISA’s list since
Jun 12, 2026 (federal fix deadline Jun 15, 2026)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com cisa.gov
Apr 30, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVE-2026-41940 · WordPress plugins & themes · reported by VulnCheckExploitedRansomwareCritical 9.3
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Product
cPanel & WHM and WP2 (WordPress Squared)
On CISA’s list since
Apr 30, 2026 (federal fix deadline May 3, 2026)
What to do
Attackers are using this now. Install WebPros’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.cpanel.net docs.wpsquared.com
Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8n · reported by GitHubExploitedCritical 9.9
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Product
n8n
On CISA’s list since
Mar 11, 2026 (federal fix deadline Mar 25, 2026)
What to do
Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 5, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Product
SmarterMail
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog code-white.com smartertools.com
Nov 21, 2025Oracle Fusion Middleware Missing Authentication for Critical Function VulnerabilityCVE-2025-61757 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
Product
Fusion Middleware
On CISA’s list since
Nov 21, 2025 (federal fix deadline Dec 12, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com isc.sans.edu
Sep 2, 2025TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityCVE-2020-24363 · Network & remote access · TP-Link · reported by MITREExploitedHigh 8.8
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
TL-WA855RE
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog malwrforensics.com pastebin.com
Jun 9, 2025Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityCVE-2025-32433 · Other software · Erlang · reported by GitHubExploitedCritical 10
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
Product
Erlang/OTP
On CISA’s list since
Jun 9, 2025 (federal fix deadline Jun 30, 2025)
What to do
Attackers are using this now. Install Erlang’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Nov 25, 2024Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityCVE-2023-28461 · Network & remote access · Array Networks · reported by MITREExploitedRansomwareCritical 9.8
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
Product
AG/vxAG ArrayOS
On CISA’s list since
Nov 25, 2024 (federal fix deadline Dec 16, 2024)
What to do
Attackers are using this now. Install Array Networks ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.arraynetworks.net support.arraynetworks.net
Nov 13, 2023Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36846 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Nov 13, 2023Juniper Junos OS EX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36847 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Nov 13, 2023Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityCVE-2023-36851 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportportal.juniper.net supportportal.juniper.net
Aug 22, 2023Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityCVE-2023-27532 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareHigh 7.5
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
Product
Backup & Replication
On CISA’s list since
Aug 22, 2023 (federal fix deadline Sep 12, 2023)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com veeam.com
Mar 31, 2022Dasan GPON Routers Command Injection VulnerabilityCVE-2018-10562 · Other software · Dasan · reported by MITREExploitedRansomwareCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 31, 2022Dasan GPON Routers Authentication Bypass VulnerabilityCVE-2018-10561 · Other software · Dasan · reported by MITREExploitedCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Nov 3, 2021SAP NetWeaver Missing Authentication for Critical Function VulnerabilityCVE-2020-6287 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 10
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
Product
NetWeaver
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 3, 2021SAP Solution Manager Missing Authentication for Critical Function VulnerabilityCVE-2020-6207 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 9.8
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Product
Solution Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.