Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

10 results

Mar 5, 2026Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityCVE-2021-22681 · Other software · Rockwell · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Product
Multiple Products
On CISA’s list since
Mar 5, 2026 (federal fix deadline Mar 26, 2026)
What to do
Attackers are using this now. Install Rockwell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.cisa.gov us-cert.cisa.gov
Feb 18, 2026Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCVE-2026-22769 · Other software · Dell · reported by security_alert@emc.comExploitedCritical 10
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
Product
RecoverPoint for Virtual Machines (RP4VMs)
On CISA’s list since
Feb 18, 2026 (federal fix deadline Feb 21, 2026)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dell.com cloud.google.com
Jun 25, 2025Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityCVE-2019-6693 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 6.5
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Product
FortiOS
On CISA’s list since
Jun 25, 2025 (federal fix deadline Jul 16, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Mar 31, 2025Cisco Smart Licensing Utility Static Credential VulnerabilityCVE-2024-20439 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.
Product
Smart Licensing Utility
On CISA’s list since
Mar 31, 2025 (federal fix deadline Apr 21, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim Systems · reported by MITREExploitedHigh 8.1
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
Product
USAHERDS
On CISA’s list since
Dec 23, 2024 (federal fix deadline Jan 13, 2025)
What to do
Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com acclaimsystems.com
Oct 15, 2024SolarWinds Web Help Desk Hardcoded Credential VulnerabilityCVE-2024-28987 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.1
SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
Product
Web Help Desk
On CISA’s list since
Oct 15, 2024 (federal fix deadline Nov 5, 2024)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.solarwinds.com solarwinds.com
Apr 11, 2024D-Link Multiple NAS Devices Use of Hard-Coded Credentials VulnerabilityCVE-2024-3272 · Network & remote access · D-Link · reported by VulDBExploitedCritical 9.8
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
Product
Multiple NAS Devices
On CISA’s list since
Apr 11, 2024 (federal fix deadline May 2, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Jul 29, 2022Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityCVE-2022-26138 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.8
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Product
Confluence
On CISA’s list since
Jul 29, 2022 (federal fix deadline Aug 19, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog confluence.atlassian.com jira.atlassian.com
Nov 3, 2021EyesOfNetwork Use of Hard-Coded Credentials VulnerabilityCVE-2020-8657 · Other software · EyesOfNetwork · reported by MITREExploitedCritical 9.8
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
Product
EyesOfNetwork
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install EyesOfNetwork’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Nov 3, 2021Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityCVE-2020-29583 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp.zyxel.com businessforum.zyxel.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.