Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

29 results

Sep 11, 2026JFrog Artifactory Incorrect Authorization VulnerabilityCVE-2026-42016 · Other software · JFrog · reported by reefs@jfrog.comExploitedHigh 8.1
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Product
Artifactory
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Sep 11, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-42018 · Other software · JFrog · reported by reefs@jfrog.comExploitedHigh 7.5
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Product
Artifactory
On CISA’s list since
Sep 11, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Sep 2, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-82329 · Other software · JFrog · reported by reefs@jfrog.comExploitedCritical 9.8
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
Product
Artifactory
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 5, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Aug 27, 2026JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityCVE-2026-66384 · Other software · JFrog · reported by reefs@jfrog.comExploitedMedium 5.3
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
Product
Artifactory
On CISA’s list since
Aug 27, 2026 (federal fix deadline Sep 10, 2026)
What to do
Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.jfrog.com docs.jfrog.com
Jul 27, 2026Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2025-68686 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 5.9
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Product
FortiOS
On CISA’s list since
Jul 27, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Jul 14, 2026Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Active Directory Federation Services
On CISA’s list since
Jul 14, 2026 (federal fix deadline Jul 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jun 16, 2026Widget Factory Joomla Content Editor Improper Access Control VulnerabilityCVE-2026-48907 · Other software · Widget Factory · reported by security@joomla.orgExploitedCritical 10
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
Product
Joomla Content Editor
On CISA’s list since
Jun 16, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install Widget Factory’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomlacontenteditor.net cisa.gov
Jun 9, 2026Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityCVE-2026-7473 · Other software · Arista · reported by psirt@arista.comExploitedMedium 6.9
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
Product
Extensible Operating System
On CISA’s list since
Jun 9, 2026 (federal fix deadline Jun 23, 2026)
What to do
Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arista.com arista.com
Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Apr 16, 2026Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2026-34197 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Product
ActiveMQ
On CISA’s list since
Apr 16, 2026 (federal fix deadline Apr 30, 2026)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org openwall.com
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.8
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com isc.sans.org
Feb 5, 2026React Native Community CLI OS Command Injection VulnerabilityCVE-2025-11953 · Other software · React Native Community · reported by reefs@jfrog.comExploitedCritical 9.8
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Product
CLI
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install React Native Community’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com jfrog.com
Dec 5, 2025Meta React Server Components Remote Code Execution VulnerabilityCVE-2025-55182 · Other software · Meta · reported by cve-assign@fb.comExploitedRansomwareCritical 10
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Product
React Server Components
On CISA’s list since
Dec 5, 2025 (federal fix deadline Dec 12, 2025)
What to do
Attackers are using this now. Install Meta’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog react.dev facebook.com
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 7.8
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Product
VMware Aria Operations and VMware Tools
On CISA’s list since
Oct 30, 2025 (federal fix deadline Nov 20, 2025)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com openwall.com
Jul 14, 2025Wing FTP Server Improper Neutralization of Null Byte or NUL Character VulnerabilityCVE-2025-47812 · Other software · Wing FTP Server · reported by MITREExploitedCritical 10
Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).
Product
Wing FTP Server
On CISA’s list since
Jul 14, 2025 (federal fix deadline Aug 4, 2025)
What to do
Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rcesecurity.com vicarius.io
Apr 28, 2025Qualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityCVE-2025-42599 · Other software · Qualitia · reported by vultures@jpcert.or.jpExploitedCritical 9.8
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Product
Active! Mail
On CISA’s list since
Apr 28, 2025 (federal fix deadline May 19, 2025)
What to do
Attackers are using this now. Install Qualitia’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp qualitia.com
Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Product
action-setup GitHub Action
On CISA’s list since
Mar 24, 2025 (federal fix deadline Apr 14, 2025)
What to do
Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 18, 2025tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30066 · Other software · tj-actions · reported by MITREExploitedHigh 8.6
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
Product
changed-files GitHub Action
On CISA’s list since
Mar 18, 2025 (federal fix deadline Apr 8, 2025)
What to do
Attackers are using this now. Install tj-actions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.gitguardian.com github.com
Nov 2, 2023Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityCVE-2023-46604 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 10
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Product
ActiveMQ
On CISA’s list since
Nov 2, 2023 (federal fix deadline Nov 23, 2023)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org activemq.apache.org
Jul 13, 2023SolarView Compact Command Injection VulnerabilityCVE-2022-29303 · Other software · SolarView · reported by MITREExploitedCritical 9.8
SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.
Product
Compact
On CISA’s list since
Jul 13, 2023 (federal fix deadline Aug 3, 2023)
What to do
Attackers are using this now. Install SolarView’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com drive.google.com
Feb 16, 2023Cacti Command Injection VulnerabilityCVE-2022-46169 · Other software · Cacti · reported by GitHubExploitedCritical 9.8
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
Product
Cacti
On CISA’s list since
Feb 16, 2023 (federal fix deadline Mar 9, 2023)
What to do
Attackers are using this now. Install Cacti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 18, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2022-26923 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
Product
Active Directory
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Apr 11, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2021-42278 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Product
Active Directory
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Apr 11, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2021-42287 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Product
Active Directory
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows Transaction Manager Privilege Escalation VulnerabilityCVE-2017-0101 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 10, 2022Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2016-3088 · Websites & servers · Apache · reported by Red HatExploitedCritical 9.8
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Product
ActiveMQ
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org rhn.redhat.com
Jan 28, 2022Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityCVE-2017-5689 · Other software · Intel · reported by secure@intel.comExploitedCritical 9.8
Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Product
Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Intel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Jan 21, 2022Apache Struts 1 ActionForm Denial-of-Service VulnerabilityCVE-2006-1547 · Websites & servers · Apache · reported by Red HatExploitedHigh 7.5
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Product
Struts 1
On CISA’s list since
Jan 21, 2022 (federal fix deadline Jul 21, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.suse.com
Nov 3, 2021Qualcomm Multiple Chipsets Detection of Error Condition Without Action VulnerabilityCVE-2021-1906 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedMedium 6.2
Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
Product
Multiple Chipsets
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.