Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

63 results · page 1 of 2

Jul 27, 2026Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2025-68686 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 5.9
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Product
FortiOS
On CISA’s list since
Jul 27, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Jun 25, 2026PTC Windchill and FlexPLM Improper Input Validation VulnerabilityCVE-2026-12569 · Other software · PTC · reported by 0b655efc-079c-4cb9-9e8d-164871239f4eExploitedRansomwareCritical 9.3
PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.
Product
Windchill and FlexPLM
On CISA’s list since
Jun 25, 2026 (federal fix deadline Jun 28, 2026)
What to do
Attackers are using this now. Install PTC’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ptc.com cisa.gov
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0249 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com news.cnet.com
May 20, 2026Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2010-0806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com osvdb.org
Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 20, 2026Kentico Xperience Path Traversal VulnerabilityCVE-2025-2749 · Other software · Kentico · reported by VulnCheckExploitedHigh 7.2
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Product
Kentico Xperience
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com labs.watchtowr.com
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2746 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 15, 2025Adobe Experience Manager Forms Code Execution VulnerabilityCVE-2025-54253 · Other software · Adobe · reported by AdobeExploitedCritical 10
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Product
Experience Manager (AEM) Forms
On CISA’s list since
Oct 15, 2025 (federal fix deadline Nov 5, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com slcyber.io
Oct 14, 2025IGEL OS Use of a Key Past its Expiration Date VulnerabilityCVE-2025-47827 · Other software · IGEL · reported by MITREExploitedMedium 4.6
IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
Product
IGEL OS
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install IGEL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 6, 2025Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityCVE-2010-3962 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
Aug 12, 2025Microsoft Internet Explorer Resource Management Errors VulnerabilityCVE-2013-3893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Internet Explorer
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com blogs.technet.com
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Nov 14, 2024Palo Alto Networks Expedition SQL Injection VulnerabilityCVE-2024-9465 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.2
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Product
Expedition
On CISA’s list since
Nov 14, 2024 (federal fix deadline Dec 5, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com horizon3.ai
Nov 14, 2024Palo Alto Networks Expedition OS Command Injection VulnerabilityCVE-2024-9463 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.9
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Product
Expedition
On CISA’s list since
Nov 14, 2024 (federal fix deadline Dec 5, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com cisa.gov
Nov 7, 2024Palo Alto Networks Expedition Missing Authentication VulnerabilityCVE-2024-5910 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedCritical 9.3
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
Product
Expedition
On CISA’s list since
Nov 7, 2024 (federal fix deadline Nov 28, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Jul 23, 2024Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2012-4792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.
Product
Internet Explorer
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blogs.technet.com
Mar 4, 2024Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control VulnerabilityCVE-2024-21338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Product
Windows
On CISA’s list since
Mar 4, 2024 (federal fix deadline Mar 25, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com decoded.avast.io
Sep 28, 2023Red Hat JBoss RichFaces Framework Expression Language Injection VulnerabilityCVE-2018-14667 · Other software · Red Hat · reported by Red HatExploitedCritical 9.8
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Product
JBoss RichFaces Framework
On CISA’s list since
Sep 28, 2023 (federal fix deadline Oct 19, 2023)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Mar 30, 2023Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2013-3163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.
Product
Internet Explorer
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Sep 8, 2022NETGEAR Multiple Devices Exposure of Sensitive Information VulnerabilityCVE-2017-5521 · Network & remote access · NETGEAR · reported by MITREExploitedHigh 8.1
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
Product
Multiple Devices
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.netgear.com securityfocus.com
Jun 8, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2012-4969 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.1
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.vulnhunt.com dev.metasploit.com
May 25, 2022Microsoft Internet Explorer ASLR Bypass VulnerabilityCVE-2015-0071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2425 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-4123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-2817 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2013-7331 · Computers, phones & browsers · Microsoft · reported by MITREExploitedMedium 6.5
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fireeye.com kb.cert.org
May 24, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2017-0149 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2017-0210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2016-0162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityCVE-2016-3351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer and Edge
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityCVE-2016-3298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2019-0676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 4, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2014-0322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
Product
Internet Explorer
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.websense.com technet.microsoft.com
Apr 13, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2502 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
Product
Internet Explorer
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twitter.com twitter.com
Mar 28, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2017-0059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Edge and Internet Explorer Type Confusion VulnerabilityCVE-2017-0037 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
Product
Edge and Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2016-0189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 28, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2013-2551 · Computers, phones & browsers · Microsoft · reported by MITREExploitedRansomwareHigh 8.8
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog h30499.www3.hp.com twitter.com
Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Mar 25, 2022Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Mar 25, 2022Kentico Xperience Deserialization of Untrusted Data VulnerabilityCVE-2019-10068 · Other software · Kentico · reported by MITREExploitedCritical 9.8
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
Product
Xperience
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com devnet.kentico.com
Mar 25, 2022Microsoft Scripting Engine Memory Corruption VulnerabilityCVE-2018-8373 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.
Product
Internet Explorer Scripting Engine
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2013-3897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.
Product
Internet Explorer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com us-cert.gov
Mar 3, 2022Microsoft Internet Explorer Remote Code Execution VulnerabilityCVE-2013-1347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
Product
Internet Explorer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog technet.microsoft.com exploit-db.com
Feb 25, 2022Microsoft Internet Explorer Remote Code Execution VulnerabilityCVE-2017-0222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.
Product
Internet Explorer
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 15, 2022Microsoft Internet Explorer Type Confusion VulnerabilityCVE-2019-0752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
Product
Internet Explorer
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.