Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

21 results

Oct 14, 2026Palo Alto Networks PAN-OS Code Injection VulnerabilityCVE-2026-0322 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.6
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Jun 15, 2026LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityCVE-2026-54420 · Other software · LiteSpeed · reported by MITREExploitedHigh 8.5
LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.
Product
cPanel Plugin
On CISA’s list since
Jun 15, 2026 (federal fix deadline Jun 18, 2026)
What to do
Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.litespeedtech.com litespeedtech.com
May 29, 2026Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2026-0257 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareHigh 7.8
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
Product
PAN-OS
On CISA’s list since
May 29, 2026 (federal fix deadline Jun 1, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cert-portal.siemens.com
May 26, 2026LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCVE-2026-48172 · Other software · LiteSpeed · reported by MITREExploitedCritical 10
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Product
cPanel Plugin
On CISA’s list since
May 26, 2026 (federal fix deadline May 29, 2026)
What to do
Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.litespeedtech.com litespeedtech.com
May 6, 2026Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityCVE-2026-0300 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.3
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Product
PAN-OS
On CISA’s list since
May 6, 2026 (federal fix deadline May 9, 2026)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cert-portal.siemens.com
Apr 30, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVE-2026-41940 · WordPress plugins & themes · reported by VulnCheckExploitedRansomwareCritical 9.3
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Product
cPanel & WHM and WP2 (WordPress Squared)
On CISA’s list since
Apr 30, 2026 (federal fix deadline May 3, 2026)
What to do
Attackers are using this now. Install WebPros’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.cpanel.net docs.wpsquared.com
Nov 4, 2025CWP Control Web Panel OS Command Injection VulnerabilityCVE-2025-48703 · Other software · CWP · reported by MITREExploitedCritical 9
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Product
Control Web Panel
On CISA’s list since
Nov 4, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fenrisk.com control-webpanel.com
Feb 20, 2025Palo Alto Networks PAN-OS File Read VulnerabilityCVE-2025-0111 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 7.1
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Product
PAN-OS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Feb 18, 2025Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2025-0108 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.8
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Product
PAN-OS
On CISA’s list since
Feb 18, 2025 (federal fix deadline Mar 11, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com github.com
Dec 30, 2024Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityCVE-2024-3393 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.7
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Product
PAN-OS
On CISA’s list since
Dec 30, 2024 (federal fix deadline Jan 20, 2025)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Dec 4, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51378 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
Product
CyberPanel
On CISA’s list since
Dec 4, 2024 (federal fix deadline Dec 25, 2024)
What to do
Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org cwe.mitre.org
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityCVE-2024-0012 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 9.3
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityCVE-2024-9474 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareMedium 6.9
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
Product
PAN-OS
On CISA’s list since
Nov 18, 2024 (federal fix deadline Dec 9, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Nov 7, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51567 · Other software · CyberPersons · reported by MITREExploitedRansomwareCritical 10
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
Product
CyberPanel
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org cwe.mitre.org
Apr 12, 2024Palo Alto Networks PAN-OS Command Injection VulnerabilityCVE-2024-3400 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Apr 12, 2024 (federal fix deadline Apr 19, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Jan 17, 2023CWP Control Web Panel OS Command Injection VulnerabilityCVE-2022-44877 · Other software · CWP · reported by MITREExploitedCritical 9.8
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Product
Control Web Panel
On CISA’s list since
Jan 17, 2023 (federal fix deadline Feb 7, 2023)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 22, 2022Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service VulnerabilityCVE-2022-0028 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.6
A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
Product
PAN-OS
On CISA’s list since
Aug 22, 2022 (federal fix deadline Sep 12, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Aug 18, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2017-15944 · Network & remote access · Palo Alto Networks · reported by MITREExploitedCritical 9.8
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Product
PAN-OS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft IME Japanese Privilege Escalation VulnerabilityCVE-2014-4077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
Product
Input Method Editor (IME) Japanese
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com securitytracker.com
Mar 25, 2022Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2020-2021 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Product
PAN-OS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Jan 10, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2019-1579 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareHigh 8.1
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Product
PAN-OS
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com devco.re

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.