Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

27 results

Jul 27, 2026An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.CVE-2021-32088 · Other software · Quest · reported by MITRECritical 9.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Jul 27, 2026An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.CVE-2021-32087 · Other software · Quest · reported by MITREHigh 8.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Jul 27, 2026An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.CVE-2021-32086 · Other software · Quest · reported by MITRECritical 9.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Jul 27, 2026An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.CVE-2021-32085 · Other software · Quest · reported by MITREHigh 8.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Jul 27, 2026An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.CVE-2021-32084 · Other software · Quest · reported by MITRECritical 9.8
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Jul 4, 2025The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.CVE-2025-26850 · Other software · Quest · reported by MITRECritical 9.3
The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.
Product
KACE Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com
Jun 24, 2025Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.CVE-2025-32978 · Other software · reported by MITREHigh 7.5
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seralys.com
Jun 24, 2025Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.CVE-2025-32977 · Other software · reported by MITRECritical 9.6
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seralys.com
Jun 24, 2025Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.CVE-2025-32976 · Other software · reported by MITREHigh 8.8
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seralys.com
Jun 24, 2025Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Product
KACE Systems Management Appliance (SMA)
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seralys.com
Apr 30, 2024An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CVE-2024-23774 · Other software · quest · reported by MITREHigh 7.8
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components. This allows local attackers to execute code of their choice with NT Authority\SYSTEM privileges.
Product
kace_systems_management_appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Apr 30, 2024An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CVE-2024-23773 · Other software · quest · reported by MITREHigh 7.8
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component. Local attackers can delete any file of their choice with NT Authority\SYSTEM privileges.
Product
kace_systems_management_appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Apr 30, 2024An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CVE-2024-23772 · Other software · quest · reported by MITREMedium 6.6
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedulerSvc.exe, KUserAlert.exe, and Runkbot.exe components. This allows local attackers to create any file of their choice with NT Authority\SYSTEM privileges.
Product
kace_systems_management_appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Feb 28, 2023An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML.CVE-2022-38220 · Other software · Quest · reported by MITREMedium 6.1
An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Aug 2, 2022In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication.CVE-2022-30285 · Other software · Quest · reported by MITRECritical 9.8
In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Aug 2, 2022In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.CVE-2022-29808 · Other software · Quest · reported by MITREHigh 7.5
In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Aug 2, 2022A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_ageCVE-2022-29807 · Other software · Quest · reported by MITRECritical 9.8
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php serviceCVE-2019-13081 · Other software · Quest · reported by MITREMedium 5.4
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php service desk ticket functionality) that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to exeCVE-2019-13080 · Other software · Quest · reported by MITREMedium 5.4
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.CVE-2019-13079 · Other software · Quest · reported by MITREHigh 8.8
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.CVE-2019-13078 · Other software · Quest · reported by MITREHigh 8.8
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attackeCVE-2019-13077 · Other software · Quest · reported by MITREMedium 6.1
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a malicious link in order to attack authenticated users.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.CVE-2019-13076 · Other software · Quest · reported by MITREHigh 8.8
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection.CVE-2019-12918 · Other software · Quest · reported by MITRECritical 9.8
Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Nov 6, 2019A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via thCVE-2019-12917 · Other software · Quest · reported by MITREMedium 6.1
A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com quest.com
Jul 8, 2019Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting toolCVE-2019-10973 · Other software · Quest · reported by ics-cert@hq.dhs.govHigh 7.2
Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com us-cert.gov
May 24, 2019An issue was discovered in Quest KACE Systems Management Appliance before 9.1.CVE-2019-11604 · Other software · Quest · reported by MITREMedium 6.1
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.
Product
Kace Systems Management Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.