Vulnerability database

9 results

• Oct 8, 2026Strapi Cleartext Storage of Sensitive Information VulnerabilityCVE-2023-22894 · Other software · Strapi · reported by MITREExploitedMedium 4.9

  Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

  Product

  Strapi

  On CISA’s list since

  Oct 8, 2026 (federal fix deadline Oct 11, 2026)

  What to do

  Attackers are using this now. Install Strapi’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comstrapi.io

• Aug 4, 2026Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityCVE-2026-34486 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5

  Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

  Product

  Tomcat

  On CISA’s list since

  Aug 4, 2026 (federal fix deadline Aug 7, 2026)

  What to do

  Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.apache.orgvicarius.io

• Jul 27, 2026Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2025-68686 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 5.9

  Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

  Product

  FortiOS

  On CISA’s list since

  Jul 27, 2026 (federal fix deadline Aug 10, 2026)

  What to do

  Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfortiguard.fortinet.comcisa.gov

• Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5

  Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

  Product

  Catalyst SD-WAN Manager

  On CISA’s list since

  Apr 20, 2026 (federal fix deadline Apr 23, 2026)

  What to do

  Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov

• Jan 13, 2025Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-48365 · Other software · Qlik · reported by MITREExploitedRansomwareCritical 9.6

  Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

  Product

  Sense

  On CISA’s list since

  Jan 13, 2025 (federal fix deadline Feb 3, 2025)

  What to do

  Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com

• Dec 7, 2023Qlik Sense Path Traversal VulnerabilityCVE-2023-41266 · Other software · Qlik · reported by MITREExploitedRansomwareHigh 8.2

  Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

  Product

  Sense

  On CISA’s list since

  Dec 7, 2023 (federal fix deadline Dec 28, 2023)

  What to do

  Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com

• Dec 7, 2023Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-41265 · Other software · Qlik · reported by MITREExploitedRansomwareCritical 9.6

  Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

  Product

  Sense

  On CISA’s list since

  Dec 7, 2023 (federal fix deadline Dec 28, 2023)

  What to do

  Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.qlik.comcommunity.qlik.com

• May 19, 2023Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilityCVE-2023-21492 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4

  Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.

  Product

  Mobile Devices

  On CISA’s list since

  May 19, 2023 (federal fix deadline Jun 9, 2023)

  What to do

  Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurity.samsungmobile.comsecurity.samsungmobile.com

• Sep 8, 2022NETGEAR Multiple Devices Exposure of Sensitive Information VulnerabilityCVE-2017-5521 · Network & remote access · NETGEAR · reported by MITREExploitedHigh 8.1

  Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.

  Product

  Multiple Devices

  On CISA’s list since

  Sep 8, 2022 (federal fix deadline Sep 29, 2022)

  What to do

  Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogkb.netgear.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.