Vulnerability database

7 results

• Aug 17, 2026Ray-Project Ray Code Injection VulnerabilityCVE-2025-62593 · Other software · Ray-Project · reported by GitHubExploitedCritical 9.4

  Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

  Product

  Ray

  On CISA’s list since

  Aug 17, 2026 (federal fix deadline Aug 20, 2026)

  What to do

  Attackers are using this now. Install Ray-Project’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Mar 27, 2025Google Chromium Mojo Sandbox Escape VulnerabilityCVE-2025-2783 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.3

  Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  Product

  Chromium Mojo

  On CISA’s list since

  Mar 27, 2025 (federal fix deadline Apr 17, 2025)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comissues.chromium.org

• Dec 3, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSend · reported by VulnCheckExploitedCritical 9.8

  ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

  Product

  ProjectSend

  On CISA’s list since

  Dec 3, 2024 (federal fix deadline Dec 24, 2024)

  What to do

  Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Nov 12, 2024Metabase GeoJSON API Local File Inclusion VulnerabilityCVE-2021-41277 · Other software · Metabase · reported by GitHubExploitedCritical 10

  Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

  Product

  Metabase

  On CISA’s list since

  Nov 12, 2024 (federal fix deadline Dec 3, 2024)

  What to do

  Attackers are using this now. Install Metabase’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Aug 13, 2024Microsoft Project Remote Code Execution Vulnerability CVE-2024-38189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8

  Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.

  Product

  Project

  On CISA’s list since

  Aug 13, 2024 (federal fix deadline Sep 3, 2024)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov

• Sep 8, 2022Google Chromium Mojo Insufficient Data Validation VulnerabilityCVE-2022-3075 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  Product

  Chromium Mojo

  On CISA’s list since

  Sep 8, 2022 (federal fix deadline Sep 29, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Mar 25, 2022Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityCVE-2019-1003030 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedCritical 9.9

  Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

  Product

  Matrix Project Plugin

  On CISA’s list since

  Mar 25, 2022 (federal fix deadline Apr 15, 2022)

  What to do

  Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.