Vulnerability database

13 results

• Jun 5, 2026SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilityCVE-2026-28318 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 7.5

  SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

  Product

  Serv-U

  On CISA’s list since

  Jun 5, 2026 (federal fix deadline Jun 19, 2026)

  What to do

  Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogdocumentation.solarwinds.comsolarwinds.com

• May 1, 2026Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityCVE-2026-31431 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8

  Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

  Product

  Kernel

  On CISA’s list since

  May 1, 2026 (federal fix deadline May 15, 2026)

  What to do

  Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggit.kernel.orggit.kernel.org

• Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8n · reported by GitHubExploitedCritical 9.9

  n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.

  Product

  n8n

  On CISA’s list since

  Mar 11, 2026 (federal fix deadline Mar 25, 2026)

  What to do

  Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Oct 22, 2025Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel VulnerabilityCVE-2025-61932 · Other software · Motex · reported by vultures@jpcert.or.jpExploitedCritical 9.3

  Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.

  Product

  LANSCOPE Endpoint Manager

  On CISA’s list since

  Oct 22, 2025 (federal fix deadline Nov 12, 2025)

  What to do

  Attackers are using this now. Install Motex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogjvn.jpmotex.co.jp

• Aug 12, 2025Microsoft Internet Explorer Resource Management Errors VulnerabilityCVE-2013-3893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8

  Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  Product

  Internet Explorer

  On CISA’s list since

  Aug 12, 2025 (federal fix deadline Sep 2, 2025)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblogs.technet.comblogs.technet.com

• Jul 1, 2025TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityCVE-2025-48927 · Other software · TeleMessage · reported by MITREExploitedMedium 5.3

  TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.

  Product

  TM SGNL

  On CISA’s list since

  Jul 1, 2025 (federal fix deadline Jul 22, 2025)

  What to do

  Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogwired.comcisa.gov

• Mar 4, 2025Linux Kernel Use of Uninitialized Resource VulnerabilityCVE-2024-50302 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedMedium 5.5

  The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.

  Product

  Kernel

  On CISA’s list since

  Mar 4, 2025 (federal fix deadline Mar 25, 2025)

  What to do

  Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggit.kernel.orggit.kernel.org

• Mar 3, 2025Microsoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityCVE-2018-8639 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8

  Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

  Product

  Windows

  On CISA’s list since

  Mar 3, 2025 (federal fix deadline Mar 24, 2025)

  What to do

  Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comportal.msrc.microsoft.com

• Jul 17, 2024Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityCVE-2024-34102 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8

  Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

  Product

  Commerce and Magento Open Source

  On CISA’s list since

  Jul 17, 2024 (federal fix deadline Aug 7, 2024)

  What to do

  Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloghelpx.adobe.comvicarius.io

• Jan 8, 2024Apache Superset Insecure Default Initialization of Resource VulnerabilityCVE-2023-27524 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.9

  Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

  Product

  Superset

  On CISA’s list since

  Jan 8, 2024 (federal fix deadline Jan 29, 2024)

  What to do

  Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.apache.orgpacketstormsecurity.com

• Aug 25, 2022Apache CouchDB Insecure Default Initialization of Resource VulnerabilityCVE-2022-24706 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8

  Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.

  Product

  CouchDB

  On CISA’s list since

  Aug 25, 2022 (federal fix deadline Sep 15, 2022)

  What to do

  Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

• Mar 3, 2022Cisco IOS Software Resource Management Errors VulnerabilityCVE-2018-0161 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.3

  A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.

  Product

  IOS Software

  On CISA’s list since

  Mar 3, 2022 (federal fix deadline Mar 17, 2022)

  What to do

  Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com

• Feb 15, 2022Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityCVE-2022-24086 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8

  Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

  Product

  Commerce and Magento Open Source

  On CISA’s list since

  Feb 15, 2022 (federal fix deadline Mar 1, 2022)

  What to do

  Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloghelpx.adobe.comhelpx.adobe.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.