Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

51 results · page 1 of 2

Oct 28, 2026Broadcom VMWare ESX Insufficient Logging VulnerabilityCVE-2026-41709 · Other software · Broadcom · reported by security@vmware.comExploitedLow 2.7
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Product
VMware ESX
On CISA’s list since
Oct 28, 2026 (federal fix deadline Nov 11, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Oct 27, 2026Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48356 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.3
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Product
Commerce and Magento
On CISA’s list since
Oct 27, 2026 (federal fix deadline Nov 10, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com sansec.io
Aug 18, 2026Broadcom VMware vCenter Path Traversal VulnerabilityCVE-2026-59310 · Other software · Broadcom · reported by security@vmware.comExploitedRansomwareCritical 9.8
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Product
VMware vCenter
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com medium.com
Aug 7, 2026Progress LoadMaster Command Injection VulnerabilityCVE-2026-8037 · Other software · Progress · reported by security@progress.comExploitedCritical 9.6
Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
Product
LoadMaster
On CISA’s list since
Aug 7, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.progress.com labs.watchtowr.com
Jul 10, 2026Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-56291 · Other software · Balbooa · reported by security@joomla.orgExploitedCritical 10
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
Product
Forms
On CISA’s list since
Jul 10, 2026 (federal fix deadline Jul 13, 2026)
What to do
Attackers are using this now. Install Balbooa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mysites.guru balbooa.com
Jul 10, 2026iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48939 · Other software · iCagenda · reported by security@joomla.orgExploitedCritical 10
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Product
iCagenda
On CISA’s list since
Jul 10, 2026 (federal fix deadline Jul 13, 2026)
What to do
Attackers are using this now. Install iCagenda’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog icagenda.com github.com
Jul 7, 2026JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48908 · Other software · JoomShaper · reported by security@joomla.orgExploitedCritical 10
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Product
SP Page Builder
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install JoomShaper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomshaper.com extensions.joomla.org
Apr 13, 2026Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityCVE-2012-1854 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
Product
Visual Basic for Applications (VBA)
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Apr 2, 2026TrueConf Client Download of Code Without Integrity Check VulnerabilityCVE-2026-3502 · Other software · TrueConf · reported by cve@checkpoint.comExploitedHigh 7.8
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
Product
Client
On CISA’s list since
Apr 2, 2026 (federal fix deadline Apr 16, 2026)
What to do
Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog trueconf.com research.checkpoint.com
Mar 3, 2026Broadcom VMware Aria Operations Command Injection VulnerabilityCVE-2026-22719 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 8.1
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
Product
VMware Aria Operations
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog knowledge.broadcom.com support.broadcom.com
Feb 17, 2026TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2024-7694 · Other software · TeamT5 · reported by twcert@cert.org.twExploitedHigh 7.2
TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
Product
ThreatSonar Anti-Ransomware
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install TeamT5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
Feb 12, 2026Notepad++ Download of Code Without Integrity Check VulnerabilityCVE-2025-15556 · Other software · Notepad++ · reported by VulnCheckExploitedHigh 7.7
Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.
Product
Notepad++
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Notepad++’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.notepad-plus-plus.org github.com
Jan 26, 2026SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2025-52691 · Other software · SmarterTools · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4ExploitedRansomwareCritical 10
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csa.gov.sg github.com
Jan 23, 2026Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityCVE-2024-37079 · Other software · Broadcom · reported by security@vmware.comExploitedCritical 9.8
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
Product
VMware vCenter Server
On CISA’s list since
Jan 23, 2026 (federal fix deadline Feb 13, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Dec 12, 2025Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2018-4063 · Other software · Sierra Wireless · reported by talos-cna@cisco.comExploitedHigh 8.8
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
AirLink ALEOS
On CISA’s list since
Dec 12, 2025 (federal fix deadline Jan 2, 2026)
What to do
Attackers are using this now. Install Sierra Wireless’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Dec 3, 2025OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2021-26828 · Other software · OpenPLC · reported by MITREExploitedHigh 8.8
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Product
ScadaBR
On CISA’s list since
Dec 3, 2025 (federal fix deadline Dec 24, 2025)
What to do
Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.scadabr.com.br packetstormsecurity.com
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 7.8
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Product
VMware Aria Operations and VMware Tools
On CISA’s list since
Oct 30, 2025 (federal fix deadline Nov 20, 2025)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com openwall.com
Sep 29, 2025Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityCVE-2025-10035 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffExploitedRansomwareCritical 10
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Product
GoAnywhere MFT
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortra.com cisa.gov
Aug 5, 2025D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityCVE-2022-40799 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
DNR-322L
On CISA’s list since
Aug 5, 2025 (federal fix deadline Aug 26, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com gitlab.com
Apr 29, 2025SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2025-31324 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 10
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Product
NetWeaver
On CISA’s list since
Apr 29, 2025 (federal fix deadline May 20, 2025)
What to do
Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog me.sap.com url.sap
Apr 28, 2025Broadcom Brocade Fabric OS Code Injection VulnerabilityCVE-2025-1976 · Other software · Broadcom · reported by sirt@brocade.comExploitedHigh 8.6
Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.
Product
Brocade Fabric OS
On CISA’s list since
Apr 28, 2025 (federal fix deadline May 19, 2025)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 10, 2025Advantive VeraCore Unrestricted File Upload VulnerabilityCVE-2024-57968 · Other software · Advantive · reported by MITREExploitedCritical 9.9
Advantive VeraCore contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload files to unintended folders via upload.apsx.
Product
VeraCore
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Advantive’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advantive.my.site.com intezer.com
Feb 6, 2025CyberoamOS (CROS) SQL Injection VulnerabilityCVE-2020-29574 · Network & remote access · Sophos · reported by MITREExploitedRansomwareCritical 9.8
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
Product
CyberoamOS
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bleepingcomputer.com cyberoam.com
Dec 17, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Product
Multiple Products
On CISA’s list since
Dec 17, 2024 (federal fix deadline Jan 7, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com support.cleo.com
Dec 13, 2024Cleo Multiple Products Unrestricted File Upload VulnerabilityCVE-2024-50623 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
Product
Multiple Products
On CISA’s list since
Dec 13, 2024 (federal fix deadline Jan 3, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com cisa.gov
Nov 18, 2024Progress Kemp LoadMaster OS Command Injection VulnerabilityCVE-2024-1212 · Other software · Progress · reported by security@progress.comExploitedCritical 10
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Product
Kemp LoadMaster
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog freeloadbalancer.com kemptechnologies.com
Aug 23, 2024Versa Director Dangerous File Type Upload VulnerabilityCVE-2024-39717 · Other software · Versa · reported by support@hackerone.comExploitedHigh 7.2
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Product
Director
On CISA’s list since
Aug 23, 2024 (federal fix deadline Sep 13, 2024)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog versa-networks.com cisa.gov
Sep 18, 2023Laravel Ignition File Upload VulnerabilityCVE-2021-3129 · Other software · Laravel · reported by MITREExploitedRansomwareCritical 9.8
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
Product
Ignition
On CISA’s list since
Sep 18, 2023 (federal fix deadline Oct 9, 2023)
What to do
Attackers are using this now. Install Laravel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 27, 2023ZK Framework AuUploader Unspecified VulnerabilityCVE-2022-36537 · Other software · ZK Framework · reported by MITREExploitedRansomwareHigh 7.5
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
Product
AuUploader
On CISA’s list since
Feb 27, 2023 (federal fix deadline Mar 20, 2023)
What to do
Attackers are using this now. Install ZK Framework’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tracker.zkoss.org bleepingcomputer.com
Feb 10, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · Fortra · reported by cve@rapid7.comExploitedRansomwareHigh 7.2
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Product
GoAnywhere MFT
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Oct 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-41352 · Email & office · Synacor · reported by MITREExploitedRansomwareCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 20, 2022 (federal fix deadline Nov 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.zimbra.org
Aug 25, 2022dotCMS Unrestricted Upload of File VulnerabilityCVE-2022-26352 · Other software · dotCMS · reported by MITREExploitedRansomwareCritical 9.8
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
Product
dotCMS
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install dotCMS’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com groups.google.com
Aug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-27925 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.2
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Jun 9, 2022SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2021-38163 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 9.9
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Product
NetWeaver
On CISA’s list since
Jun 9, 2022 (federal fix deadline Jun 30, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog launchpad.support.sap.com wiki.scn.sap.com
Apr 25, 2022WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityCVE-2022-29464 · Other software · WSO2 · reported by MITREExploitedRansomwareCritical 9.8
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
Product
Multiple Products
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install WSO2’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Apr 11, 2022Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityCVE-2017-11317 · Other software · Telerik · reported by MITREExploitedCritical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Product
User Interface (UI) for ASP.NET AJAX
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Telerik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com telerik.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Jan 18, 2022Aviatrix Controller Unrestricted Upload of FileCVE-2021-40870 · Other software · Aviatrix · reported by MITREExploitedCritical 9.8
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Product
Aviatrix Controller
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com docs.aviatrix.com
Jan 18, 2022Drupal core Un-restricted Upload of FileCVE-2020-13671 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedHigh 8.8
Improper sanitization in the extension file names is present in Drupal core.
Product
Drupal core
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Jan 10, 2022FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitCVE-2021-27860 · Other software · FatPipe · reported by cret@cert.orgExploitedCritical 9.8
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Product
WARP, IPVPN, and MPVPN software
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install FatPipe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fatpipeinc.com ic3.gov
Dec 10, 2021Fortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedLow 3.3
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Product
FortiOS
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Dec 10, 2021Embedthis GoAhead Remote Code Execution VulnerabilityCVE-2017-17562 · Other software · Embedthis · reported by MITREExploitedHigh 8.1
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Product
GoAhead
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Embedthis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securitytracker.com
Nov 3, 2021Microsoft Windows CryptoAPI Spoofing VulnerabilityCVE-2020-0601 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Adobe ColdFusion Unrestricted File Upload VulnerabilityCVE-2018-15961 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Product
ColdFusion
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Office OLE DLL Side Loading VulnerabilityCVE-2016-3235 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 3, 2021Ivanti Pulse Connect Secure Unrestricted File Upload VulnerabilityCVE-2021-22900 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Product
Pulse Connect Secure
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.pulsesecure.net kb.pulsesecure.net
Nov 3, 2021SonicWall Email Security Unrestricted Upload of File VulnerabilityCVE-2021-20022 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareHigh 7.2
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Nov 3, 2021VMware vCenter Server File Upload VulnerabilityCVE-2021-22005 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Nov 3, 2021WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Product
Snap Creek Duplicator Plugin
Fixed in
1.3.28
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Zoho ManageEngine Desktop Central File Upload VulnerabilityCVE-2020-10189 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.