Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Nov 12, 2025Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.CVE-2025-25236 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52Medium 5.3
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Aug 11, 2025Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability.CVE-2025-25229 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52Medium 5.4
Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomnissa.comomnissa.com
Aug 11, 2025Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability.CVE-2025-25231 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.5
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Jun 27, 2024VMware Workspace One UEM update addresses an information exposure vulnerability.CVE-2024-22260 · Other software · vmware · reported by security@vmware.comMedium 6.8
VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One UEM may be able to perform an attack resulting in an information exposure.
- Product
- workspace_one_uem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023VMware Workspace ONE UEM console contains an open redirect vulnerability.CVE-2023-20886 · Other software · VMware · reported by security@vmware.comHigh 8.8
VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.
- Product
- Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021Omnissa Workspace ONE Server-Side Request ForgeryCVE-2021-22054 · Other software · Omnissa · reported by security@vmware.comExploitedHigh 7.5
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
- Product
- Workspace One UEM
- On CISA’s list since
- Mar 9, 2026 (federal fix deadline Mar 23, 2026)
- What to do
- Attackers are using this now. Install Omnissa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogvmware.comvmware.com
Aug 31, 2021VMware Workspace ONE UEM REST API contains a denial of service vulnerability.CVE-2021-22029 · Other software · VMware · reported by security@vmware.comHigh 7.5
VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting.
- Product
- Workspace ONE UEM Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2CVE-2021-21990 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to 20.1.0.32, 1912 prior to 19.12.0.24) contain a cross-site scripting vulnerability. VMware Workspace ONE UEM console does not validate incoming requests during device enrollment after leading to rendering of unsanitized input on the user device in response.
- Product
- Workspace ONE Unified Endpoint Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.devmware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.