Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

186 results · page 1 of 4

Oct 13, 2026Microsoft Windows Command Injection VulnerabilityCVE-2026-96951 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Oct 13, 2026 (federal fix deadline Oct 16, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 8, 2026Microsoft Windows Link Following VulnerabilityCVE-2026-81963 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
Product
Windows
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 22, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 8, 2026Microsoft Windows Heap-Based Buffer Overflow VulnerabilityCVE-2026-85880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 22, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 11, 2026Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2026-68820 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows Ancillary Function Driver for WinSock
On CISA’s list since
Aug 11, 2026 (federal fix deadline Aug 25, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 20, 2026Microsoft Windows Buffer Overflow VulnerabilityCVE-2008-4250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
Product
Windows
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.securiteam.com marc.info
Apr 28, 2026Microsoft Windows Protection Mechanism Failure VulnerabilityCVE-2026-32202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 28, 2026 (federal fix deadline May 12, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 13, 2026Microsoft Windows Out-of-Bounds Read VulnerabilityCVE-2023-36424 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
Product
Windows
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 13, 2026Microsoft Windows Link Following VulnerabilityCVE-2025-60710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
Product
Windows
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 27, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.8
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com isc.sans.org
Feb 10, 2026Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVE-2026-21510 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 10, 2026Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVE-2026-21513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 10, 2026Microsoft Windows Improper Privilege Management VulnerabilityCVE-2026-21533 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 10, 2026Microsoft Windows NULL Pointer Dereference VulnerabilityCVE-2026-21525 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.2
Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 10, 2026Microsoft Windows Type Confusion VulnerabilityCVE-2026-21519 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 13, 2026Microsoft Windows Information Disclosure VulnerabilityCVE-2026-20805 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.
Product
Windows
On CISA’s list since
Jan 13, 2026 (federal fix deadline Feb 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Dec 9, 2025Microsoft Windows Use After Free VulnerabilityCVE-2025-62221 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Dec 9, 2025 (federal fix deadline Dec 30, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Nov 12, 2025Microsoft Windows Race Condition VulnerabilityCVE-2025-62215 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
Product
Windows
On CISA’s list since
Nov 12, 2025 (federal fix deadline Dec 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 24, 2025Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityCVE-2025-59287 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Oct 24, 2025 (federal fix deadline Nov 14, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com hawktrace.com
Oct 20, 2025Microsoft Windows SMB Client Improper Access Control VulnerabilityCVE-2025-33073 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Product
Windows
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Oct 14, 2025Microsoft Windows Untrusted Pointer Dereference VulnerabilityCVE-2025-24990 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
Product
Windows
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Oct 14, 2025Microsoft Windows Improper Access Control VulnerabilityCVE-2025-59230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Oct 6, 2025Microsoft Windows Out-of-Bounds Write VulnerabilityCVE-2013-3918 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com darkreading.com
Oct 6, 2025Microsoft Windows Remote Code Execution VulnerabilityCVE-2011-3402 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.mcafee.com blogs.technet.com
Oct 6, 2025Microsoft Windows Privilege Escalation VulnerabilityCVE-2021-43226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Jun 10, 2025 Microsoft Windows External Control of File Name or Path VulnerabilityCVE-2025-33053 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
Product
Windows
On CISA’s list since
Jun 10, 2025 (federal fix deadline Jul 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com research.checkpoint.com
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2025-32706 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
May 13, 2025Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2025-32709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows DWM Core Library Use-After-Free VulnerabilityCVE-2025-30400 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Scripting Engine Type Confusion VulnerabilityCVE-2025-30397 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-32701 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Apr 17, 2025Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityCVE-2025-24054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Apr 8, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-29824 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 11, 2025Microsoft Windows NTFS Information Disclosure VulnerabilityCVE-2025-24984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.6
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows Win32k Use-After-Free VulnerabilityCVE-2025-24983 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows NTFS Out-Of-Bounds Read VulnerabilityCVE-2025-24991 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityCVE-2025-24993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityCVE-2025-24985 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 11, 2025Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCVE-2025-26633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 3, 2025Microsoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityCVE-2018-8639 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Product
Windows
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Feb 11, 2025Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityCVE-2025-21418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 11, 2025Microsoft Windows Storage Link Following VulnerabilityCVE-2025-21391 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.1
Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.
Product
Windows
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21335 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityCVE-2025-21333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Dec 16, 2024Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Dec 10, 2024Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2024-49138 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 10, 2024 (federal fix deadline Dec 31, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstorm.news
Nov 12, 2024Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityCVE-2024-43451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Product
Windows
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Nov 12, 2024Microsoft Windows Task Scheduler Privilege Escalation VulnerabilityCVE-2024-49039 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
Product
Windows
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Oct 15, 2024Microsoft Windows Kernel TOCTOU Race Condition VulnerabilityCVE-2024-30088 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
Product
Windows
On CISA’s list since
Oct 15, 2024 (federal fix deadline Nov 5, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 8, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43573 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.