Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

61 results · page 1 of 2

Oct 14, 2026Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVE-2026-76519 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Oct 14, 2026 (federal fix deadline Oct 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Oct 1, 2026Fortinet FortiMail Path Traversal VulnerabilityCVE-2026-104286 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
Product
FortiMail
On CISA’s list since
Oct 1, 2026 (federal fix deadline Oct 4, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Sep 14, 2026Cisco Secure Email Gateway SQL Injection VulnerabilityCVE-2026-76461 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
Product
Secure Email Gateway
On CISA’s list since
Sep 14, 2026 (federal fix deadline Sep 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Sep 2, 2026BerriAI LiteLLM Improper Authentication VulnerabilityCVE-2026-59822 · Other software · BerriAI · reported by GitHubExploitedHigh 8.8
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Product
LiteLLM
On CISA’s list since
Sep 2, 2026 (federal fix deadline Sep 16, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 5, 2026JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityCVE-2026-63077 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Product
TeamCity
On CISA’s list since
Aug 5, 2026 (federal fix deadline Aug 8, 2026)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jetbrains.com cisa.gov
Jun 8, 2026BerriAI LiteLLM Command Injection VulnerabilityCVE-2026-42271 · Other software · BerriAI · reported by GitHubExploitedHigh 8.7
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
Product
LiteLLM
On CISA’s list since
Jun 8, 2026 (federal fix deadline Jun 22, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 8, 2026BerriAI LiteLLM SQL Injection VulnerabilityCVE-2026-42208 · Other software · BerriAI · reported by GitHubExploitedCritical 9.3
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
Product
LiteLLM
On CISA’s list since
May 8, 2026 (federal fix deadline May 11, 2026)
What to do
Attackers are using this now. Install BerriAI’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 28, 2026Microsoft Windows Protection Mechanism Failure VulnerabilityCVE-2026-32202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 28, 2026 (federal fix deadline May 12, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 20, 2026JetBrains TeamCity Relative Path Traversal VulnerabilityCVE-2024-27199 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareHigh 7.3
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
Product
TeamCity
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com
Feb 20, 2026RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCVE-2025-49113 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.9
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.
Product
Webmail
On CISA’s list since
Feb 20, 2026 (federal fix deadline Mar 13, 2026)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fearsoff.org github.com
Feb 20, 2026RoundCube Webmail Cross-site Scripting VulnerabilityCVE-2025-68461 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.2
RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.
Product
Webmail
On CISA’s list since
Feb 20, 2026 (federal fix deadline Mar 13, 2026)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com roundcube.net
Feb 10, 2026Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVE-2026-21513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 10, 2026Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVE-2026-21510 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 5, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Product
SmarterMail
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog code-white.com smartertools.com
Jan 26, 2026SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2025-52691 · Other software · SmarterTools · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4ExploitedRansomwareCritical 10
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csa.gov.sg github.com
Jan 26, 2026SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-23760 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog code-white.com labs.watchtowr.com
Dec 12, 2025Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2018-4063 · Other software · Sierra Wireless · reported by talos-cna@cisco.comExploitedHigh 8.8
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
AirLink ALEOS
On CISA’s list since
Dec 12, 2025 (federal fix deadline Jan 2, 2026)
What to do
Attackers are using this now. Install Sierra Wireless’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Sep 29, 2025Libraesva Email Security Gateway Command Injection VulnerabilityCVE-2025-59689 · Other software · Libraesva · reported by MITREExploitedMedium 6.1
Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.
Product
Email Security Gateway
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Libraesva’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.libraesva.com libraesva.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2775 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 22, 2025SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-2776 · Other software · SysAid · reported by VulnCheckExploitedCritical 9.3
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Product
SysAid On-Prem
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install SysAid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com labs.watchtowr.com
Jul 7, 2025Rails Ruby on Rails Path Traversal VulnerabilityCVE-2019-5418 · Other software · Rails · reported by support@hackerone.comExploitedHigh 7.5
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
Product
Ruby on Rails
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Rails’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
Jul 7, 2025PHPMailer Command Injection VulnerabilityCVE-2016-10033 · Websites & servers · PHP · reported by MITREExploitedCritical 9.8
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Product
PHPMailer
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install PHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 9, 2025RoundCube Webmail Cross-Site Scripting VulnerabilityCVE-2024-42009 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.3
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Product
Webmail
On CISA’s list since
Jun 9, 2025 (federal fix deadline Jun 30, 2025)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 19, 2025MDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityCVE-2024-11182 · Other software · MDaemon · reported by security@eset.comExploitedMedium 5.3
MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.
Product
Email Server
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install MDaemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog files.mdaemon.com cisa.gov
Apr 28, 2025Qualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityCVE-2025-42599 · Other software · Qualitia · reported by vultures@jpcert.or.jpExploitedCritical 9.8
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Product
Active! Mail
On CISA’s list since
Apr 28, 2025 (federal fix deadline May 19, 2025)
What to do
Attackers are using this now. Install Qualitia’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp qualitia.com
Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim Systems · reported by MITREExploitedHigh 8.1
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
Product
USAHERDS
On CISA’s list since
Dec 23, 2024 (federal fix deadline Jan 13, 2025)
What to do
Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com acclaimsystems.com
Oct 24, 2024RoundCube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2024-37383 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.
Product
Webmail
On CISA’s list since
Oct 24, 2024 (federal fix deadline Nov 14, 2024)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Sep 10, 2024Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure VulnerabilityCVE-2024-38217 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.4
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
Product
Windows
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com elastic.co
Sep 10, 2024Microsoft Publisher Protection Mechanism Failure VulnerabilityCVE-2024-38226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.
Product
Publisher
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jun 26, 2024Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-13965 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
Product
Webmail
On CISA’s list since
Jun 26, 2024 (federal fix deadline Jul 17, 2024)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 26, 2024OSGeo GeoServer JAI-EXT Code Injection VulnerabilityCVE-2022-24816 · Other software · OSGeo · reported by GitHubExploitedCritical 10
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
Product
JAI-EXT
On CISA’s list since
Jun 26, 2024 (federal fix deadline Jul 17, 2024)
What to do
Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 7, 2024JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2024-27198 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
Product
TeamCity
On CISA’s list since
Mar 7, 2024 (federal fix deadline Mar 28, 2024)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog darkreading.com jetbrains.com
Feb 12, 2024Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-43770 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
Product
Webmail
On CISA’s list since
Feb 12, 2024 (federal fix deadline Mar 4, 2024)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com lists.debian.org
Nov 13, 2023SysAid Server Path Traversal VulnerabilityCVE-2023-47246 · Other software · SysAid · reported by MITREExploitedRansomwareCritical 9.8
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
Product
SysAid Server
On CISA’s list since
Nov 13, 2023 (federal fix deadline Dec 4, 2023)
What to do
Attackers are using this now. Install SysAid’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.sysaid.com documentation.sysaid.com
Oct 26, 2023Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-5631 · Websites & servers · Roundcube · reported by security@eset.comExploitedMedium 6.1
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
Product
Webmail
On CISA’s list since
Oct 26, 2023 (federal fix deadline Nov 16, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Oct 4, 2023JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2023-42793 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Product
TeamCity
On CISA’s list since
Oct 4, 2023 (federal fix deadline Oct 25, 2023)
What to do
Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Jun 22, 2023Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityCVE-2020-35730 · Websites & servers · Roundcube · reported by MITREExploitedMedium 6.1
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.debian.org github.com
Jun 22, 2023Roundcube Webmail Remote Code Execution VulnerabilityCVE-2020-12641 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org github.com
Jun 22, 2023Roundcube Webmail SQL Injection VulnerabilityCVE-2021-44026 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bugs.debian.org github.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
Aug 18, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2022-26923 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
Product
Active Directory
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
May 25, 2022Adobe Flash Player and AIR Integer Overflow VulnerabilityCVE-2016-1010 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.
Product
Flash Player and AIR
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
May 25, 2022Adobe Flash Player and AIR Use-After-Free VulnerabilityCVE-2016-0984 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.
Product
Flash Player and AIR
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Apr 15, 2022Ubiquiti AirOS Command Injection VulnerabilityCVE-2010-5330 · Network & remote access · Ubiquiti · reported by MITREExploitedCritical 9.8
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Product
AirOS
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ubnt.com exploit-db.com
Apr 11, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2021-42278 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Product
Active Directory
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Apr 11, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2021-42287 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Product
Active Directory
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 25, 2022Ruby on Rails Directory Traversal VulnerabilityCVE-2016-0752 · Other software · Rails · reported by Red HatExploitedHigh 7.5
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Product
Ruby on Rails
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Rails’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Mar 25, 2022Ruby on Rails Directory Traversal VulnerabilityCVE-2014-0130 · Other software · Rails · reported by Red HatExploitedHigh 7.5
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
Product
Ruby on Rails
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Rails’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog matasano.com rhn.redhat.com
Mar 3, 2022Exim Out-of-bounds Write VulnerabilityCVE-2019-16928 · Other software · Exim · reported by MITREExploitedCritical 9.8
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Product
Exim Internet Mailer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Jan 28, 2022GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityCVE-2014-6271 · Other software · GNU · reported by security@debian.orgExploitedCritical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
Product
Bourne-Again Shell (Bash)
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org archives.neohapsis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.