Vulnerability database

9 results

• Jun 9, 2026Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityCVE-2026-7473 · Other software · Arista · reported by psirt@arista.comExploitedMedium 6.9

  Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

  Product

  Extensible Operating System

  On CISA’s list since

  Jun 9, 2026 (federal fix deadline Jun 23, 2026)

  What to do

  Attackers are using this now. Install Arista’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogarista.comarista.com

• Dec 5, 2025Meta React Server Components Remote Code Execution VulnerabilityCVE-2025-55182 · Other software · Meta · reported by cve-assign@fb.comExploitedRansomwareCritical 10

  Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

  Product

  React Server Components

  On CISA’s list since

  Dec 5, 2025 (federal fix deadline Dec 12, 2025)

  What to do

  Attackers are using this now. Install Meta’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogreact.devfacebook.com

• Mar 13, 2025Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityCVE-2025-21590 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 6.7

  Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.

  Product

  Junos OS

  On CISA’s list since

  Mar 13, 2025 (federal fix deadline Apr 3, 2025)

  What to do

  Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcloud.google.comsupportportal.juniper.net

• Jul 29, 2024ServiceNow Incomplete List of Disallowed Inputs VulnerabilityCVE-2024-5217 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.2

  ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

  Product

  Utah, Vancouver, and Washington DC Now Platform

  On CISA’s list since

  Jul 29, 2024 (federal fix deadline Aug 19, 2024)

  What to do

  Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsupport.servicenow.comsupport.servicenow.com

• Apr 30, 2024Microsoft SmartScreen Prompt Security Feature Bypass VulnerabilityCVE-2024-29988 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8

  Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.

  Product

  SmartScreen Prompt

  On CISA’s list since

  Apr 30, 2024 (federal fix deadline May 21, 2024)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com

• Jul 13, 2023SolarView Compact Command Injection VulnerabilityCVE-2022-29303 · Other software · SolarView · reported by MITREExploitedCritical 9.8

  SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

  Product

  Compact

  On CISA’s list since

  Jul 13, 2023 (federal fix deadline Aug 3, 2023)

  What to do

  Attackers are using this now. Install SolarView’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comdrive.google.com

• Feb 14, 2023Microsoft Windows Graphic Component Privilege Escalation VulnerabilityCVE-2023-21823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8

  Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.

  Product

  Windows

  On CISA’s list since

  Feb 14, 2023 (federal fix deadline Mar 7, 2023)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com

• Feb 15, 2022Microsoft Graphics Component Memory Corruption VulnerabilityCVE-2013-3906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8

  Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

  Product

  Graphics Component

  On CISA’s list since

  Feb 15, 2022 (federal fix deadline Aug 15, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblogs.mcafee.comblogs.technet.com

• Dec 1, 2021Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8

  Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  Product

  Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  On CISA’s list since

  Dec 1, 2021 (federal fix deadline Jun 1, 2022)

  What to do

  Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogqualcomm.comqualcomm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.