Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

16 results

Mar 4, 2025VMware ESXi Arbitrary Write VulnerabilityCVE-2025-22225 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 8.2
VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
Product
ESXi
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityCVE-2025-22226 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.1
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
Product
ESXi, Workstation, and Fusion
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Mar 4, 2025VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityCVE-2025-22224 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.3
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Product
ESXi and Workstation
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Jul 30, 2024VMware ESXi Authentication Bypass VulnerabilityCVE-2024-37085 · Other software · VMware · reported by security@vmware.comExploitedRansomwareMedium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Product
ESXi
On CISA’s list since
Jul 30, 2024 (federal fix deadline Aug 20, 2024)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Mar 25, 2022Exim Heap-Based Buffer Overflow VulnerabilityCVE-2010-4344 · Other software · Exim · reported by Red HatExploitedCritical 9.8
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
Product
Exim
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp.exim.org atmail.com
Mar 25, 2022Exim Privilege Escalation VulnerabilityCVE-2010-4345 · Other software · Exim · reported by Red HatExploitedHigh 7.8
Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
Product
Exim
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.exim.org lists.exim.org
Mar 3, 2022Exim Out-of-bounds Write VulnerabilityCVE-2019-16928 · Other software · Exim · reported by MITREExploitedCritical 9.8
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Product
Exim Internet Mailer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25296 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25298 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 18, 2022Nagios XI OS Command InjectionCVE-2021-25297 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Product
Nagios XI
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2022Exim Mail Transfer Agent (MTA) Improper Input ValidationCVE-2019-10149 · Other software · Exim · reported by Red HatExploitedCritical 9.8
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Product
Mail Transfer Agent (MTA)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
Nov 17, 2021ExifTool Remote Code Execution VulnerabilityCVE-2021-22204 · Other software · Perl · reported by cve@gitlab.comExploitedMedium 6.8
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Product
Exiftool
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Perl’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Nagios XI Remote Code Execution VulnerabilityCVE-2019-15949 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
Product
Nagios XI
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Exim Buffer Overflow VulnerabilityCVE-2018-6789 · Other software · Exim · reported by MITREExploitedRansomwareCritical 9.8
Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
Product
Exim
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Exim’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com packetstormsecurity.com
Nov 3, 2021VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityCVE-2019-5544 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
Product
VMware ESXi and Horizon DaaS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Nov 3, 2021VMware ESXi OpenSLP Use-After-Free VulnerabilityCVE-2020-3992 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
Product
ESXi
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com zerodayinitiative.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.