Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

90 results · page 1 of 2

Oct 16, 2026Fortinet Multiple Products Path Traversal VulnerabilityCVE-2025-61624 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 6
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Product
Multiple Products
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cert-portal.siemens.com
Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 8, 2026ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICE · reported by MITREExploitedCritical 9.8
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Product
Docs
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Product
FortiMail
On CISA’s list since
Oct 1, 2026 (federal fix deadline Oct 4, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Sep 24, 2026WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-5430 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8ExploitedCritical 10
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
Product
Multiple Products
On CISA’s list since
Sep 24, 2026 (federal fix deadline Sep 27, 2026)
What to do
Attackers are using this now. Install WSO2’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.docs.wso2.com cisa.gov
Sep 22, 2026Check Point Multiple Products Path Traversal VulnerabilityCVE-2026-93616 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.8
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Product
Multiple Products
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com blog.checkpoint.com
Sep 11, 2026GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVE-2026-85706 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
Product
Community Edition and Enterprise Edition
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 14, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Aug 18, 2026Broadcom VMware vCenter Path Traversal VulnerabilityCVE-2026-59310 · Other software · Broadcom · reported by security@vmware.comExploitedRansomwareCritical 9.8
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
Product
VMware vCenter
On CISA’s list since
Aug 18, 2026 (federal fix deadline Aug 21, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com medium.com
Jul 7, 2026Adobe ColdFusion Path Traversal VulnerabilityCVE-2026-48282 · Websites & servers · Adobe · reported by AdobeExploitedCritical 10
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
Product
ColdFusion
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com cisa.gov
Jun 23, 2026Ubiquiti UniFi OS Path Traversal VulnerabilityCVE-2026-34909 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
Product
UniFi OS
On CISA’s list since
Jun 23, 2026 (federal fix deadline Jun 26, 2026)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ui.com cisa.gov
Jun 15, 2026Cisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityCVE-2026-20262 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Jun 15, 2026 (federal fix deadline Jun 29, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
May 21, 2026Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityCVE-2026-34926 · Other software · Trend Micro · reported by security@trendmicro.comExploitedMedium 6.7
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.
Product
Apex One
On CISA’s list since
May 21, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
Apr 28, 2026ConnectWise ScreenConnect Path Traversal VulnerabilityCVE-2024-1708 · Other software · ConnectWise · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedRansomwareHigh 8.4
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
Product
ScreenConnect
On CISA’s list since
Apr 28, 2026 (federal fix deadline May 12, 2026)
What to do
Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog connectwise.com huntress.com
Apr 24, 2026Samsung MagicINFO 9 Server Path Traversal VulnerabilityCVE-2024-7399 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comExploitedHigh 8.8
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
Product
MagicINFO 9 Server
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungtv.com arcticwolf.com
Apr 24, 2026SimpleHelp Path Traversal VulnerabilityCVE-2024-57728 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.2
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Product
SimpleHelp
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Apr 20, 2026Kentico Xperience Path Traversal VulnerabilityCVE-2025-2749 · Other software · Kentico · reported by VulnCheckExploitedHigh 7.2
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Product
Kentico Xperience
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com labs.watchtowr.com
Apr 20, 2026JetBrains TeamCity Relative Path Traversal VulnerabilityCVE-2024-27199 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareHigh 7.3
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
Product
TeamCity
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com
Feb 25, 2026Cisco SD-WAN Path Traversal VulnerabilityCVE-2022-20775 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.8
Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Product
SD-WAN
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com github.com
Jan 22, 2026Versa Concerto Improper Authentication VulnerabilityCVE-2025-34026 · Other software · Versa · reported by VulnCheckExploitedCritical 9.2
Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.
Product
Concerto
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog projectdiscovery.io projectdiscovery.io
Jan 12, 2026Gogs Path Traversal VulnerabilityCVE-2025-8110 · Other software · Gogs · reported by 9947ef80-c5d5-474a-bbab-97341a59000eExploitedHigh 8.7
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Product
Gogs
On CISA’s list since
Jan 12, 2026 (federal fix deadline Feb 2, 2026)
What to do
Attackers are using this now. Install Gogs’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiz.io openwall.com
Dec 9, 2025RARLAB WinRAR Path Traversal VulnerabilityCVE-2025-6218 · Other software · RARLAB · reported by zdi-disclosures@trendmicro.comExploitedHigh 7.8
RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
Product
WinRAR
On CISA’s list since
Dec 9, 2025 (federal fix deadline Dec 30, 2025)
What to do
Attackers are using this now. Install RARLAB’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog win-rar.com zerodayinitiative.com
Nov 14, 2025Fortinet FortiWeb Path Traversal VulnerabilityCVE-2025-64446 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
Product
FortiWeb
On CISA’s list since
Nov 14, 2025 (federal fix deadline Nov 21, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com github.com
Oct 9, 2025Grafana Path Traversal VulnerabilityCVE-2021-43798 · Other software · Grafana Labs · reported by GitHubExploitedHigh 7.5
Grafana contains a path traversal vulnerability that could allow access to local files.
Product
Grafana
On CISA’s list since
Oct 9, 2025 (federal fix deadline Oct 30, 2025)
What to do
Attackers are using this now. Install Grafana Labs’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 12, 2025RARLAB WinRAR Path Traversal VulnerabilityCVE-2025-8088 · Other software · RARLAB · reported by security@eset.comExploitedRansomwareHigh 8.4
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.
Product
WinRAR
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install RARLAB’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog win-rar.com arstechnica.com
Jul 7, 2025Rails Ruby on Rails Path Traversal VulnerabilityCVE-2019-5418 · Other software · Rails · reported by support@hackerone.comExploitedHigh 7.5
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Product
Ruby on Rails
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Rails’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
Jun 25, 2025 D-Link DIR-859 Router Path Traversal VulnerabilityCVE-2024-0769 · Network & remote access · D-Link · reported by VulDBExploitedMedium 5.3
D-Link DIR-859 routers contain a path traversal vulnerability in the file /hedwig.cgi of the component HTTP POST Request Handler. Manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml allows for the leakage of session data potentially enabling privilege escalation and unauthorized control of the device. This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
Product
DIR-859 Router
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
May 22, 2025Samsung MagicINFO 9 Server Path Traversal VulnerabilityCVE-2025-4632 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comExploitedCritical 9.8
Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.
Product
MagicINFO 9 Server
On CISA’s list since
May 22, 2025 (federal fix deadline Jun 12, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungtv.com cisa.gov
May 19, 2025ZKTeco BioTime Path Traversal VulnerabilityCVE-2023-38950 · Other software · ZKTeco · reported by MITREExploitedHigh 7.5
ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.
Product
BioTime
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install ZKTeco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog claroty.com claroty.com
May 19, 2025Srimax Output Messenger Directory Traversal VulnerabilityCVE-2025-27920 · Other software · Srimax · reported by MITREExploitedHigh 7.2
Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Product
Output Messenger
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install Srimax’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog outputmessenger.com srimax.com
May 2, 2025Commvault Command Center Path Traversal VulnerabilityCVE-2025-34028 · Other software · Commvault · reported by VulnCheckExploitedCritical 9.3
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
Product
Command Center
On CISA’s list since
May 2, 2025 (federal fix deadline May 23, 2025)
What to do
Attackers are using this now. Install Commvault’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.commvault.com github.com
Mar 19, 2025SAP NetWeaver Directory Traversal VulnerabilityCVE-2017-12637 · Network & remote access · SAP · reported by MITREExploitedHigh 7.5
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Product
NetWeaver
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog web.archive.org cisa.gov
Mar 19, 2025NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityCVE-2024-48248 · Other software · NAKIVO · reported by MITREExploitedHigh 8.6
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
Product
Backup and Replication
On CISA’s list since
Mar 19, 2025 (federal fix deadline Apr 9, 2025)
What to do
Attackers are using this now. Install NAKIVO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpcenter.nakivo.com labs.watchtowr.com
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13161 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13160 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 10, 2025Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityCVE-2024-13159 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.8
Ivanti Endpoint Manager (EPM) contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information.
Product
Endpoint Manager (EPM)
On CISA’s list since
Mar 10, 2025 (federal fix deadline Mar 31, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 3, 2025Progress WhatsUp Gold Path Traversal VulnerabilityCVE-2024-4885 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.
Product
WhatsUp Gold
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.progress.com progress.com
Feb 13, 2025SimpleHelp Path Traversal VulnerabilityCVE-2024-57727 · Other software · SimpleHelp · reported by MITREExploitedRansomwareHigh 7.5
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
Product
SimpleHelp
On CISA’s list since
Feb 13, 2025 (federal fix deadline Mar 6, 2025)
What to do
Attackers are using this now. Install SimpleHelp ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog simple-help.com horizon3.ai
Jan 7, 2025Mitel MiCollab Path Traversal VulnerabilityCVE-2024-55550 · Email & office · Mitel · reported by MITREExploitedRansomwareLow 2.7
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Product
MiCollab
On CISA’s list since
Jan 7, 2025 (federal fix deadline Jan 28, 2025)
What to do
Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mitel.com mitel.com
Jan 7, 2025Mitel MiCollab Path Traversal VulnerabilityCVE-2024-41713 · Email & office · Mitel · reported by MITREExploitedRansomwareCritical 9.1
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Product
MiCollab
On CISA’s list since
Jan 7, 2025 (federal fix deadline Jan 28, 2025)
What to do
Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mitel.com cisa.gov
Dec 3, 2024Zyxel Multiple Firewalls Path Traversal VulnerabilityCVE-2024-11667 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedRansomwareHigh 7.5
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
Product
Multiple Firewalls
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Nov 12, 2024Atlassian Jira Server and Data Center Path Traversal VulnerabilityCVE-2021-26086 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedMedium 5.3
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
Product
Jira Server and Data Center
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com
Nov 7, 2024Nostromo nhttpd Directory Traversal VulnerabilityCVE-2019-16278 · Other software · Nostromo · reported by MITREExploitedCritical 9.8
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
Product
nhttpd
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Nostromo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 19, 2024Ivanti Cloud Services Appliance (CSA) Path Traversal VulnerabilityCVE-2024-8963 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedCritical 9.4
Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.
Product
Cloud Services Appliance (CSA)
On CISA’s list since
Sep 19, 2024 (federal fix deadline Oct 10, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Sep 3, 2024Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20123 · Network & remote access · DrayTek · reported by vulnreport@tenable.comExploitedHigh 7.5
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Product
VigorConnect
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tenable.com tenable.com
Sep 3, 2024Kingsoft WPS Office Path Traversal VulnerabilityCVE-2024-7262 · Other software · Kingsoft · reported by security@eset.comExploitedCritical 9.3
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
Product
WPS Office
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install Kingsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wps.com cisa.gov
Sep 3, 2024Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20124 · Network & remote access · DrayTek · reported by vulnreport@tenable.comExploitedHigh 7.5
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Product
VigorConnect
On CISA’s list since
Sep 3, 2024 (federal fix deadline Sep 24, 2024)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tenable.com tenable.com
Aug 23, 2024Versa Director Dangerous File Type Upload VulnerabilityCVE-2024-39717 · Other software · Versa · reported by support@hackerone.comExploitedHigh 7.2
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Product
Director
On CISA’s list since
Aug 23, 2024 (federal fix deadline Sep 13, 2024)
What to do
Attackers are using this now. Install Versa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog versa-networks.com cisa.gov
Aug 19, 2024Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityCVE-2024-23897 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedRansomwareCritical 9.8
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
Product
Jenkins Command Line Interface (CLI)
On CISA’s list since
Aug 19, 2024 (federal fix deadline Sep 9, 2024)
What to do
Attackers are using this now. Install Jenkins’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 7, 2024Apache OFBiz Path Traversal VulnerabilityCVE-2024-32113 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Product
OFBiz
On CISA’s list since
Aug 7, 2024 (federal fix deadline Aug 28, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com issues.apache.org
Jul 17, 2024SolarWinds Serv-U Path Traversal Vulnerability CVE-2024-28995 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 8.6
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
Product
Serv-U
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog solarwinds.com solarwinds.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.