Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

39 results

Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICE · reported by MITREExploitedCritical 9.8
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Product
Docs
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 14, 2026Microsoft Office Remote Code ExecutionCVE-2009-0238 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
Product
Office
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.zdnet.com isc.sans.org
Feb 10, 2026Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCVE-2026-21514 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Office
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 26, 2026Microsoft Office Security Feature Bypass VulnerabilityCVE-2026-21509 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Office
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Jan 7, 2026Microsoft Office PowerPoint Code Injection VulnerabilityCVE-2009-0556 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.
Product
Office
On CISA’s list since
Jan 7, 2026 (federal fix deadline Jan 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
Aug 12, 2025Microsoft Office Excel Remote Code Execution VulnerabilityCVE-2007-0671 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Product
Office
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Feb 6, 2025Microsoft Outlook Improper Input Validation VulnerabilityCVE-2024-21413 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
Product
Office Outlook
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Sep 3, 2024Kingsoft WPS Office Path Traversal VulnerabilityCVE-2024-7262 · Other software · Kingsoft · reported by security@eset.comExploitedCritical 9.3
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
Product
WPS Office
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install Kingsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wps.com cisa.gov
Mar 14, 2023Microsoft Office Outlook Privilege Escalation VulnerabilityCVE-2023-23397 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
Product
Office
On CISA’s list since
Mar 14, 2023 (federal fix deadline Apr 4, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 14, 2023Microsoft Office Publisher Security Feature Bypass VulnerabilityCVE-2023-21715 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Product
Office
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 8, 2022Microsoft Office Buffer Overflow VulnerabilityCVE-2013-1331 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.
Product
Office
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Jun 8, 2022Microsoft Office Object Record Corruption VulnerabilityCVE-2009-0557 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
Product
Office
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org securityfocus.com
Jun 8, 2022Microsoft Office Buffer Overflow VulnerabilityCVE-2009-0563 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.
Product
Office
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org securityfocus.com
Mar 28, 2022Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityCVE-2021-38646 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 28, 2022Microsoft Office Uninitialized Memory Use VulnerabilityCVE-2015-1770 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
Product
Office
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Stack-based Buffer Overflow VulnerabilityCVE-2010-3333 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.idefense.com secunia.com
Mar 3, 2022Microsoft Office Use-After-Free VulnerabilityCVE-2017-0261 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-11826 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Security Feature Bypass VulnerabilityCVE-2016-7262 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.
Product
Excel
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Memory Corruption VulnerabilityCVE-2016-7193 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Malformed EPS File VulnerabilityCVE-2015-2545 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.morphisec.com securitytracker.com
Mar 3, 2022Microsoft Office Memory Corruption VulnerabilityCVE-2015-1642 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 3, 2022Microsoft Office MSCOMCTL.OCX Remote Code Execution VulnerabilityCVE-2012-1856 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com us-cert.gov
Feb 25, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-8570 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.
Product
Office
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com github.com
Feb 10, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-0262 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office.
Product
Office
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Nov 17, 2021Microsoft Excel Security Feature BypassCVE-2021-42292 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.
Product
Office
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Trend Micro Apex One and OfficeScan Authentication Bypass VulnerabilityCVE-2020-8599 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
Product
Apex One and OfficeScan
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Microsoft Office Memory Corruption VulnerabilityCVE-2018-0798 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Office Memory Corruption VulnerabilityCVE-2018-0802 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Office Memory Corruption VulnerabilityCVE-2015-1641 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Office Memory Corruption VulnerabilityCVE-2017-11882 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog reversingminds-blog.logdown.com securityfocus.com
Nov 3, 2021Microsoft Office Remote Code Execution VulnerabilityCVE-2021-27059 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.6
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Office and WordPad Remote Code Execution VulnerabilityCVE-2017-0199 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
Product
Office and WordPad
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rewtin.blogspot.nl securityfocus.com
Nov 3, 2021Microsoft Office OLE DLL Side Loading VulnerabilityCVE-2016-3235 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 3, 2021Trend Micro OfficeScan Directory Traversal VulnerabilityCVE-2019-18187 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.5
Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution.
Product
OfficeScan
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Apex One and OfficeScan Remote Code Execution VulnerabilityCVE-2020-8467 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
Product
Apex One and OfficeScan
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Content Validation Escape VulnerabilityCVE-2020-8468 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Product
Apex One, OfficeScan and Worry-Free Business Security Agents
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Microsoft Office Outlook Security Feature Bypass VulnerabilityCVE-2017-11774 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
Product
Office
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.