Vulnerability database

4 results

• Jul 15, 2026KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityCVE-2023-4346 · Other software · KNX Association · reported by ics-cert@hq.dhs.govExploitedHigh 7.5

  KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.

  Product

  KNX Protocol Connection Authorization Option 1

  On CISA’s list since

  Jul 15, 2026 (federal fix deadline Jul 29, 2026)

  What to do

  Attackers are using this now. Install KNX Association’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcisa.govcisa.gov

• Mar 20, 2026Apple Multiple Products Improper Locking VulnerabilityCVE-2025-43510 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8

  Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.

  Product

  Multiple Products

  On CISA’s list since

  Mar 20, 2026 (federal fix deadline Apr 3, 2026)

  What to do

  Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsupport.apple.comsupport.apple.com

• Jun 27, 2022Google Chromium PopupBlocker Security Bypass VulnerabilityCVE-2021-30533 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5

  Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  Product

  Chromium PopupBlocker

  On CISA’s list since

  Jun 27, 2022 (federal fix deadline Jul 18, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Nov 3, 2021Microsoft Windows Server Message Block (SMBv1) Remote Code Execution VulnerabilityCVE-2017-0143 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8

  Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.

  Product

  Windows

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.