Vulnerability database

7 results

• Jan 7, 2026Hewlett Packard Enterprise (HPE) OneView Code Injection VulnerabilityCVE-2025-37164 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comExploitedCritical 10

  Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.

  Product

  OneView

  On CISA’s list since

  Jan 7, 2026 (federal fix deadline Jan 28, 2026)

  What to do

  Attackers are using this now. Install Hewlett Packard Enterprise (HPE)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsupport.hpe.comgithub.com

• Oct 14, 2025SKYSEA Client View Improper Authentication VulnerabilityCVE-2016-7836 · Other software · SKYSEA · reported by vultures@jpcert.or.jpExploitedCritical 9.8

  SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.

  Product

  Client View

  On CISA’s list since

  Oct 14, 2025 (federal fix deadline Nov 4, 2025)

  What to do

  Attackers are using this now. Install SKYSEA’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comskyseaclientview.net

• Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6

  reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

  Product

  action-setup GitHub Action

  On CISA’s list since

  Mar 24, 2025 (federal fix deadline Apr 14, 2025)

  What to do

  Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• May 29, 2024Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityCVE-2024-4978 · Other software · Justice AV Solutions · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.7

  Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

  Product

  Viewer

  On CISA’s list since

  May 29, 2024 (federal fix deadline Jun 19, 2024)

  What to do

  Attackers are using this now. Install Justice AV Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogtwitter.comjavs.com

• Jul 13, 2023SolarView Compact Command Injection VulnerabilityCVE-2022-29303 · Other software · SolarView · reported by MITREExploitedCritical 9.8

  SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

  Product

  Compact

  On CISA’s list since

  Jul 13, 2023 (federal fix deadline Aug 3, 2023)

  What to do

  Attackers are using this now. Install SolarView’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comdrive.google.com

• Mar 25, 2022HP OpenView Network Node Manager Remote Code Execution VulnerabilityCVE-2005-2773 · Other software · Hewlett Packard (HP) · reported by MITREExploitedCritical 9.8

  HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.

  Product

  OpenView Network Node Manager

  On CISA’s list since

  Mar 25, 2022 (federal fix deadline Apr 15, 2022)

  What to do

  Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmarc.infosecunia.com

• Nov 3, 2021TeamViewer Desktop Bypass Remote Login VulnerabilityCVE-2019-18988 · Other software · TeamViewer · reported by MITREExploitedHigh 7

  TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).

  Product

  Desktop

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install TeamViewer’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.teamviewer.comcommunity.teamviewer.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.