Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

115 results · page 1 of 3

Oct 29, 2026GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityCVE-2026-97229 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Product
Community Edition and Enterprise Edition
On CISA’s list since
Oct 29, 2026 (federal fix deadline Nov 1, 2026)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.gitlab.com gitlab.com
Sep 25, 2026Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedMedium 6.9
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
Product
RouterOS
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert.pl cert.pl
Sep 22, 2026F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCVE-2026-94127 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.3
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.
Product
BIG-IP APM
On CISA’s list since
Sep 22, 2026 (federal fix deadline Sep 25, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog my.f5.com cisa.gov
Sep 21, 2026Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCVE-2026-7273 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedHigh 8.8
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Product
GS1900 Series Switches
On CISA’s list since
Sep 21, 2026 (federal fix deadline Sep 24, 2026)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com cisa.gov
Sep 9, 2026Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityCVE-2025-25249 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedHigh 8.1
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.
Product
Multiple Products
On CISA’s list since
Sep 9, 2026 (federal fix deadline Sep 12, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cert-portal.siemens.com
Sep 8, 2026Microsoft Windows Heap-Based Buffer Overflow VulnerabilityCVE-2026-85880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Sep 8, 2026 (federal fix deadline Sep 22, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 19, 2026MLflow Server-Side Request Forgery VulnerabilityCVE-2026-64849 · Other software · MLflow · reported by GitHubExploitedCritical 9.3
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Product
MLflow
On CISA’s list since
Aug 19, 2026 (federal fix deadline Sep 2, 2026)
What to do
Attackers are using this now. Install MLflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 4, 2026IBM Langflow Code Injection VulnerabilityCVE-2026-9198 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.8
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Product
Langflow
On CISA’s list since
Aug 4, 2026 (federal fix deadline Aug 7, 2026)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ibm.com cisa.gov
Jul 21, 2026Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2026-0770 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comExploitedCritical 9.8
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
Product
Langflow
On CISA’s list since
Jul 21, 2026 (federal fix deadline Jul 24, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zerodayinitiative.com cisa.gov
Jul 21, 2026DD-WRT Stack-Based Buffer Overflow VulnerabilityCVE-2021-27137 · Other software · DD-WRT · reported by MITREExploitedHigh 8.1
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
Product
DD-WRT
On CISA’s list since
Jul 21, 2026 (federal fix deadline Jul 24, 2026)
What to do
Attackers are using this now. Install DD-WRT’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityaffairs.com ssd-disclosure.com
Jul 7, 2026Langflow Authorization Bypass Through User-Controlled Key VulnerabilityCVE-2026-55255 · Other software · Langflow · reported by GitHubExploitedHigh 8.4
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
Product
Langflow
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 2, 2026Android Framework Integer Overflow VulnerabilityCVE-2025-48595 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 8.4
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
Product
Framework
On CISA’s list since
Jun 2, 2026 (federal fix deadline Jun 5, 2026)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com cisa.gov
May 21, 2026Langflow Origin Validation Error VulnerabilityCVE-2025-34291 · Other software · Langflow · reported by VulnCheckExploitedCritical 9.4
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
Product
Langflow
On CISA’s list since
May 21, 2026 (federal fix deadline Jun 4, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com obsidiansecurity.com
May 20, 2026Microsoft Windows Buffer Overflow VulnerabilityCVE-2008-4250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
Product
Windows
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.securiteam.com marc.info
May 20, 2026Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityCVE-2009-3459 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
Product
Acrobat and Reader
On CISA’s list since
May 20, 2026 (federal fix deadline Jun 3, 2026)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com isc.sans.org
Mar 27, 2026F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityCVE-2025-53521 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedCritical 9.3
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Product
BIG-IP
On CISA’s list since
Mar 27, 2026 (federal fix deadline Mar 30, 2026)
What to do
Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog my.f5.com cisa.gov
Mar 25, 2026Langflow Code Injection VulnerabilityCVE-2026-33017 · Other software · Langflow · reported by GitHubExploitedCritical 9.3
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Product
Langflow
On CISA’s list since
Mar 25, 2026 (federal fix deadline Apr 8, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Mar 20, 2026Apple Multiple Products Classic Buffer Overflow VulnerabilityCVE-2025-43520 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 20, 2026Apple Multiple Products Buffer Overflow VulnerabilityCVE-2025-31277 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Product
Multiple Products
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Mar 5, 2026Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCVE-2021-30952 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com lists.fedoraproject.org
Feb 12, 2026Apple Multiple Buffer Overflow VulnerabilityCVE-2026-20700 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
Product
Multiple Products
On CISA’s list since
Feb 12, 2026 (federal fix deadline Mar 5, 2026)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Jan 26, 2026Linux Kernel Integer Overflow VulnerabilityCVE-2018-14634 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 7.8
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
Product
Kernel
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com securityfocus.com
Dec 8, 2025D-Link Routers Buffer Overflow VulnerabilityCVE-2022-37055 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Routers
On CISA’s list since
Dec 8, 2025 (federal fix deadline Dec 29, 2025)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog drive.google.com supportannouncement.us.dlink.com
Sep 25, 2025Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityCVE-2025-20333 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.9
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.
Product
Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
On CISA’s list since
Sep 25, 2025 (federal fix deadline Sep 26, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 26, 2025Citrix NetScaler Memory Overflow VulnerabilityCVE-2025-7775 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.2
Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Product
NetScaler
On CISA’s list since
Aug 26, 2025 (federal fix deadline Aug 28, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
Jul 7, 2025Multi-Router Looking Glass (MRLG) Buffer Overflow VulnerabilityCVE-2014-3931 · Other software · Looking Glass · reported by MITREExploitedCritical 9.8
Multi-Router Looking Glass (MRLG) contains a buffer overflow vulnerability that could allow remote attackers to cause an arbitrary memory write and memory corruption.
Product
Multi-Router Looking Glass (MRLG)
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install Looking Glass’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mrlg.op-sec.us s3.eurecom.fr
Jun 30, 2025Citrix NetScaler ADC and Gateway Buffer Overflow VulnerabilityCVE-2025-6543 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.2
Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Product
NetScaler ADC and Gateway
On CISA’s list since
Jun 30, 2025 (federal fix deadline Jul 21, 2025)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com cisa.gov
May 14, 2025Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityCVE-2025-32756 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
Product
Multiple Products
On CISA’s list since
May 14, 2025 (federal fix deadline Jun 4, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2025-32706 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
May 5, 2025Langflow Missing Authentication VulnerabilityCVE-2025-3248 · Other software · Langflow · reported by VulnCheckExploitedRansomwareCritical 9.8
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
Product
Langflow
On CISA’s list since
May 5, 2025 (federal fix deadline May 26, 2025)
What to do
Attackers are using this now. Install Langflow’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 28, 2025Qualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityCVE-2025-42599 · Other software · Qualitia · reported by vultures@jpcert.or.jpExploitedCritical 9.8
Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request.
Product
Active! Mail
On CISA’s list since
Apr 28, 2025 (federal fix deadline May 19, 2025)
What to do
Attackers are using this now. Install Qualitia’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp qualitia.com
Apr 4, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-22457 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedRansomwareCritical 9
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Apr 4, 2025 (federal fix deadline Apr 11, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Mar 11, 2025Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityCVE-2025-24993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 11, 2025Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityCVE-2025-24985 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 11, 2025Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityCVE-2025-21418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 6, 2025Sophos XG Firewall Buffer Overflow VulnerabilityCVE-2020-15069 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
Product
XG Firewall
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.sophos.com community.sophos.com
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityCVE-2025-21333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Jan 8, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-0282 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedRansomwareCritical 9
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Product
Connect Secure, Policy Secure, and ZTA Gateways
On CISA’s list since
Jan 8, 2025 (federal fix deadline Jan 15, 2025)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cloud.google.com
Dec 10, 2024Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2024-49138 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 10, 2024 (federal fix deadline Dec 31, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstorm.news
Nov 20, 2024VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38812 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
Product
vCenter Server
On CISA’s list since
Nov 20, 2024 (federal fix deadline Dec 11, 2024)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Sep 17, 2024Adobe Flash Player Integer Underflow VulnerablityCVE-2014-0497 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
Product
Flash Player
On CISA’s list since
Sep 17, 2024 (federal fix deadline Oct 8, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog googlechromereleases.blogspot.com helpx.adobe.com
Aug 21, 2024Linux Kernel Heap-Based Buffer Overflow VulnerabilityCVE-2022-0185 · Computers, phones & browsers · Linux · reported by Red HatExploitedHigh 8.4
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
Product
Kernel
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org github.com
Jan 17, 2024Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-6549 · Network & remote access · Citrix · reported by secure@citrix.comExploitedHigh 8.2
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Jan 17, 2024 (federal fix deadline Feb 7, 2024)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Jan 2, 2024Google Chromium WebRTC Heap Buffer Overflow VulnerabilityCVE-2023-7024 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
Product
Chromium WebRTC
On CISA’s list since
Jan 2, 2024 (federal fix deadline Jan 23, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Dec 5, 2023Qualcomm Multiple Chipsets Integer Overflow VulnerabilityCVE-2023-33107 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.4
Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Product
Multiple Chipsets
On CISA’s list since
Dec 5, 2023 (federal fix deadline Dec 26, 2023)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Nov 30, 2023Google Skia Integer Overflow VulnerabilityCVE-2023-6345 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Product
Chromium Skia
On CISA’s list since
Nov 30, 2023 (federal fix deadline Dec 21, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 21, 2023GNU C Library Buffer Overflow VulnerabilityCVE-2023-4911 · Other software · GNU · reported by Red HatExploitedHigh 7.8
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Product
GNU C Library
On CISA’s list since
Nov 21, 2023 (federal fix deadline Dec 12, 2023)
What to do
Attackers are using this now. Install GNU’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog access.redhat.com access.redhat.com
Oct 18, 2023Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-4966 · Network & remote access · Citrix · reported by secure@citrix.comExploitedRansomwareCritical 9.4
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Product
NetScaler ADC and NetScaler Gateway
On CISA’s list since
Oct 18, 2023 (federal fix deadline Nov 8, 2023)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Oct 2, 2023Google Chromium libvpx Heap Buffer Overflow VulnerabilityCVE-2023-5217 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Product
Chromium libvpx
On CISA’s list since
Oct 2, 2023 (federal fix deadline Oct 23, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 13, 2023Google Chromium WebP Heap-Based Buffer Overflow VulnerabilityCVE-2023-4863 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Product
Chromium WebP
On CISA’s list since
Sep 13, 2023 (federal fix deadline Oct 4, 2023)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.