Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

15 results

Oct 30, 2025XWiki Platform Eval Injection VulnerabilityCVE-2025-24893 · Other software · XWiki · reported by GitHubExploitedCritical 9.8
XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
Product
Platform
On CISA’s list since
Oct 30, 2025 (federal fix deadline Nov 20, 2025)
What to do
Attackers are using this now. Install XWiki’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 2, 2025Meta Platforms WhatsApp Incorrect Authorization VulnerabilityCVE-2025-55177 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedMedium 5.4
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Product
WhatsApp
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog facebook.com whatsapp.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Oct 8, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43573 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 16, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.
Product
Windows
On CISA’s list since
Sep 16, 2024 (federal fix deadline Oct 7, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 29, 2024ServiceNow Improper Input Validation VulnerabilityCVE-2024-4879 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.3
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.
Product
Utah, Vancouver, and Washington DC Now Platform
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.servicenow.com support.servicenow.com
Jul 29, 2024ServiceNow Incomplete List of Disallowed Inputs VulnerabilityCVE-2024-5217 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.2
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
Product
Utah, Vancouver, and Washington DC Now Platform
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.servicenow.com support.servicenow.com
Jul 9, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-38112 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
Product
Windows
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 14, 2024Microsoft Windows MSHTML Platform Security Feature Bypass VulnerabilityCVE-2024-30040 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.
Product
Windows
On CISA’s list since
May 14, 2024 (federal fix deadline Jun 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 11, 2023Microsoft Windows MSHTML Platform Privilege Escalation VulnerabilityCVE-2023-32046 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
May 23, 2022WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Product
WhatsApp
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com facebook.com
Apr 19, 2022WhatsApp VOIP Stack Buffer Overflow VulnerabilityCVE-2019-3568 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedCritical 9.8
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Product
WhatsApp
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com facebook.com
Nov 3, 2021Cisco HyperFlex HX Data Platform Command Injection VulnerabilityCVE-2021-1498 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
Product
HyperFlex HX
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Microsoft Windows MSHTML Platform Remote Code Execution VulnerabilityCVE-2021-33742 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.