Updated 30 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

54 results · page 1 of 2

Jul 27, 2026Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2025-68686 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedMedium 5.9
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Product
FortiOS
On CISA’s list since
Jul 27, 2026 (federal fix deadline Aug 10, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Apr 20, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Mar 16, 2026Wing FTP Server Information Disclosure VulnerabilityCVE-2025-47813 · Other software · Wing FTP Server · reported by MITREExploitedMedium 4.3
Wing FTP Server contains a generation of error message containing sensitive information vulnerability when using a long value in the UID cookie.
Product
Wing FTP Server
On CISA’s list since
Mar 16, 2026 (federal fix deadline Mar 30, 2026)
What to do
Attackers are using this now. Install Wing FTP Server’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com rcesecurity.com
Jan 13, 2026Microsoft Windows Information Disclosure VulnerabilityCVE-2026-20805 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.
Product
Windows
On CISA’s list since
Jan 13, 2026 (federal fix deadline Feb 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Dec 2, 2025Android Framework Information Disclosure VulnerabilityCVE-2025-48633 · Computers, phones & browsers · Android · reported by security@android.comExploitedMedium 5.5
Android Framework contains an unspecified vulnerability that allows for information disclosure.
Product
Framework
On CISA’s list since
Dec 2, 2025 (federal fix deadline Dec 23, 2025)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog android.googlesource.com source.android.com
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Apr 17, 2025Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityCVE-2025-24054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Product
Windows
On CISA’s list since
Apr 17, 2025 (federal fix deadline May 8, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Mar 11, 2025Microsoft Windows NTFS Information Disclosure VulnerabilityCVE-2025-24984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.6
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Mar 4, 2025VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityCVE-2025-22226 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.1
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
Product
ESXi, Workstation, and Fusion
On CISA’s list since
Mar 4, 2025 (federal fix deadline Mar 25, 2025)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com cisa.gov
Feb 4, 2025Microsoft .NET Framework Information Disclosure VulnerabilityCVE-2024-29059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Product
.NET Framework
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Nov 12, 2024Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityCVE-2024-43451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Product
Windows
On CISA’s list since
Nov 12, 2024 (federal fix deadline Dec 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 21, 2024Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2021-31196 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.2
Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Aug 21, 2024 (federal fix deadline Sep 11, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Jul 23, 2024Twilio Authy Information Disclosure VulnerabilityCVE-2024-39891 · Other software · Twilio · reported by MITREExploitedMedium 5.3
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Product
Authy
On CISA’s list since
Jul 23, 2024 (federal fix deadline Aug 13, 2024)
What to do
Attackers are using this now. Install Twilio’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org bleepingcomputer.com
May 30, 2024Check Point Quantum Security Gateways Information Disclosure VulnerabilityCVE-2024-24919 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedRansomwareHigh 8.6
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.
Product
Quantum Security Gateways
On CISA’s list since
May 30, 2024 (federal fix deadline Jun 20, 2024)
What to do
Attackers are using this now. Install Check Point’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.checkpoint.com support.checkpoint.com
May 16, 2024D-Link DIR-605 Router Information Disclosure VulnerabilityCVE-2021-40655 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.5
D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page.
Product
DIR-605 Router
On CISA’s list since
May 16, 2024 (federal fix deadline Jun 6, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com dlink.com
Apr 4, 2024Android Pixel Information Disclosure VulnerabilityCVE-2024-29745 · Computers, phones & browsers · Android · reported by dsap-vuln-management@google.comExploitedMedium 5.5
Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
Product
Pixel
On CISA’s list since
Apr 4, 2024 (federal fix deadline Apr 25, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Mar 5, 2024Android Pixel Information Disclosure Vulnerability CVE-2023-21237 · Computers, phones & browsers · Android · reported by security@android.comExploitedMedium 5.5
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
Product
Pixel
On CISA’s list since
Mar 5, 2024 (federal fix deadline Mar 26, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog source.android.com source.android.com
Mar 5, 2024Sunhillo SureLine OS Command Injection VulnerablityCVE-2021-36380 · Other software · Sunhillo · reported by MITREExploitedCritical 9.8
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.
Product
SureLine
On CISA’s list since
Mar 5, 2024 (federal fix deadline Mar 26, 2024)
What to do
Attackers are using this now. Install Sunhillo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog research.nccgroup.com sunhillo.com
Feb 15, 2024Cisco ASA and FTD Information Disclosure VulnerabilityCVE-2020-3259 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareHigh 7.5
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
Product
Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
On CISA’s list since
Feb 15, 2024 (federal fix deadline Mar 7, 2024)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Nov 30, 2023ownCloud graphapi Information Disclosure VulnerabilityCVE-2023-49103 · Other software · ownCloud · reported by MITREExploitedCritical 10
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.
Product
ownCloud graphapi
On CISA’s list since
Nov 30, 2023 (federal fix deadline Dec 21, 2023)
What to do
Attackers are using this now. Install ownCloud’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog owncloud.com owncloud.org
Oct 10, 2023Microsoft WordPad Information Disclosure VulnerabilityCVE-2023-36563 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.
Product
WordPad
On CISA’s list since
Oct 10, 2023 (federal fix deadline Oct 31, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Sep 12, 2023Microsoft Word Information Disclosure VulnerabilityCVE-2023-36761 · Email & office · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Word contains an unspecified vulnerability that allows for information disclosure.
Product
Word
On CISA’s list since
Sep 12, 2023 (federal fix deadline Oct 3, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 19, 2023Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure VulnerabilityCVE-2016-6415 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.
Product
IOS, IOS XR, and IOS XE
On CISA’s list since
May 19, 2023 (federal fix deadline Jun 9, 2023)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com securityfocus.com
May 12, 2023Jenkins User Interface (UI) Information Disclosure VulnerabilityCVE-2015-5317 · Websites & servers · Jenkins · reported by Red HatExploitedHigh 7.5
Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
Product
Jenkins User Interface (UI)
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com access.redhat.com
Apr 21, 2023MinIO Information Disclosure VulnerabilityCVE-2023-28432 · Other software · MinIO · reported by GitHubExploitedHigh 7.5
MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.
Product
MinIO
On CISA’s list since
Apr 21, 2023 (federal fix deadline May 12, 2023)
What to do
Attackers are using this now. Install MinIO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 7, 2023Arm Mali GPU Kernel Driver Information Disclosure VulnerabilityCVE-2023-26083 · Computers, phones & browsers · Arm · reported by MITREExploitedLow 3.3
Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com cybersecurity-help.cz
Dec 29, 2022TIBCO JasperReports Server Information Disclosure VulnerabilityCVE-2018-5430 · Other software · TIBCO · reported by security@tibco.comExploitedHigh 8.8
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Product
JasperReports
On CISA’s list since
Dec 29, 2022 (federal fix deadline Jan 19, 2023)
What to do
Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhinosecuritylabs.com exploit-db.com
Sep 8, 2022NETGEAR Multiple Devices Exposure of Sensitive Information VulnerabilityCVE-2017-5521 · Network & remote access · NETGEAR · reported by MITREExploitedHigh 8.1
Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
Product
Multiple Devices
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.netgear.com securityfocus.com
Jun 9, 2022SAP NetWeaver Information Disclosure VulnerabilityCVE-2016-2388 · Network & remote access · SAP · reported by MITREExploitedMedium 5.3
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Product
NetWeaver
On CISA’s list since
Jun 9, 2022 (federal fix deadline Jun 30, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 25, 2022Red Hat JBoss Information Disclosure VulnerabilityCVE-2010-1428 · Other software · Red Hat · reported by Red HatExploitedRansomwareHigh 7.5
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
May 25, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2013-7331 · Computers, phones & browsers · Microsoft · reported by MITREExploitedMedium 6.5
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fireeye.com kb.cert.org
May 25, 2022Microsoft Silverlight Information Disclosure VulnerabilityCVE-2013-3896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 24, 2022Apple iOS Information Disclosure VulnerabilityCVE-2016-4655 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com lists.apple.com
May 24, 2022Microsoft Windows SMBv1 Information Disclosure VulnerabilityCVE-2017-0147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Product
SMBv1 server
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 24, 2022Microsoft XML Core Services Information Disclosure VulnerabilityCVE-2017-0022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
Product
XML Core Services
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2016-0162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityCVE-2016-3351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer and Edge
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityCVE-2016-3298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Microsoft Windows SMB Information Disclosure VulnerabilityCVE-2019-0703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2019-0676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 4, 2022OpenSSL Information Disclosure VulnerabilityCVE-2014-0160 · Websites & servers · OpenSSL · reported by Red HatExploitedHigh 7.5
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Product
OpenSSL
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install OpenSSL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org blog.fox-it.com
Mar 28, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2017-0059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 7, 2022Adobe ColdFusion Information Disclosure VulnerabilityCVE-2013-0631 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
Product
ColdFusion
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com adobe.com
Mar 7, 2022Adobe BlazeDS Information Disclosure VulnerabilityCVE-2009-3960 · Other software · Adobe · reported by AdobeExploitedRansomwareMedium 6.5
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Product
BlazeDS
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securitytracker.com
Mar 3, 2022Mozilla Firefox Information Disclosure VulnerabilityCVE-2013-1675 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedMedium 6.5
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Firefox
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Jan 18, 2022Microsoft Exchange Server Information DisclosureCVE-2021-33766 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Product
Exchange Server
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Roundcube Webmail File Disclosure VulnerabilityCVE-2017-16651 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.8
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Product
Roundcube Webmail
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Nov 3, 2021Cisco Small Business RV320 and RV325 Routers Information Disclosure VulnerabilityCVE-2019-1653 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.
Product
Small Business RV320 and RV325 Routers
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8195 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8196 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 4.3
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.