Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

10 results

Aug 26, 2026Red Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityCVE-2015-5287 · Other software · Red Hat · reported by Red HatExploitedHigh 7.8
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product
Automatic Bug Reporting Tool
On CISA’s list since
Aug 26, 2026 (federal fix deadline Sep 9, 2026)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com rhn.redhat.com
Sep 18, 2024Microsoft SQL Server Reporting Services Remote Code Execution VulnerabilityCVE-2020-0618 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
Product
SQL Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 13, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Product
Telerik Report Server
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.telerik.com docs.telerik.com
Jun 13, 2024Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityCVE-2024-26169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jul 11, 2023Microsoft Windows Error Reporting Service Privilege Escalation VulnerabilityCVE-2023-36874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Dec 29, 2022TIBCO JasperReports Server Information Disclosure VulnerabilityCVE-2018-5430 · Other software · TIBCO · reported by security@tibco.comExploitedHigh 8.8
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Product
JasperReports
On CISA’s list since
Dec 29, 2022 (federal fix deadline Jan 19, 2023)
What to do
Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhinosecuritylabs.com exploit-db.com
Dec 29, 2022TIBCO JasperReports Library Directory Traversal VulnerabilityCVE-2018-18809 · Other software · TIBCO · reported by security@tibco.comExploitedMedium 6.5
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Product
JasperReports
On CISA’s list since
Dec 29, 2022 (federal fix deadline Jan 19, 2023)
What to do
Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Mar 15, 2022Microsoft Windows Error Reporting Manager Privilege Escalation VulnerabilityCVE-2019-1315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Micro Focus Operation Bridge Report (OBR) Remote Code Execution VulnerabilityCVE-2021-22502 · Other software · Micro Focus · reported by security@opentext.comExploitedCritical 9.8
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
Product
Operation Bridge Reporter (OBR)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Micro Focus’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com softwaresupport.softwaregrp.com
Nov 3, 2021Microsoft Windows Error Reporting (WER) Privilege Escalation VulnerabilityCVE-2019-0863 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.