Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

818 results · page 13 of 17

Mar 3, 2022Adobe Reader and Acrobat Memory Corruption VulnerabilityCVE-2013-3346 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adobe.com oval.cisecurity.org
Mar 3, 2022Mozilla Firefox Information Disclosure VulnerabilityCVE-2013-1675 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedMedium 6.5
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Firefox
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Microsoft Internet Explorer Remote Code Execution VulnerabilityCVE-2013-1347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
Product
Internet Explorer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog technet.microsoft.com exploit-db.com
Mar 3, 2022Adobe Reader Buffer Overflow VulnerabilityCVE-2013-0641 · Email & office · Adobe · reported by AdobeExploitedHigh 7.8
A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
Product
Reader
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blogs.adobe.com
Mar 3, 2022Adobe Reader and Acrobat Memory Corruption VulnerabilityCVE-2013-0640 · Email & office · Adobe · reported by AdobeExploitedHigh 7.8
An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com blogs.adobe.com
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-4681 · Other software · Oracle · reported by MITREExploitedRansomwareCritical 9.8
The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fireeye.com immunityproducts.blogspot.com
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-1723 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mail.openjdk.java.net marc.info
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2012-0507 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Product
Java SE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com krebsonsecurity.com
Mar 3, 2022Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityCVE-2011-3544 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.
Product
Java SE JDK and JRE
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org marc.info
Mar 3, 2022Microsoft Forefront TMG Remote Code Execution VulnerabilityCVE-2011-1889 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.
Product
Forefront Threat Management Gateway (TMG)
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com securityfocus.com
Mar 3, 2022Adobe Flash Player Remote Code Execution VulnerabilityCVE-2011-0611 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com bugix-security.blogspot.com
Mar 3, 2022Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityCVE-2010-0188 · Email & office · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org secunia.com
Mar 3, 2022Adobe Reader and Acrobat Input Validation VulnerabilityCVE-2008-2992 · Email & office · Adobe · reported by MITREExploitedRansomwareHigh 7.8
Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.
Product
Acrobat and Reader
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog download.oracle.com lists.opensuse.org
Feb 25, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-8570 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.
Product
Office
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com github.com
Feb 25, 2022Microsoft Internet Explorer Remote Code Execution VulnerabilityCVE-2017-0222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.
Product
Internet Explorer
On CISA’s list since
Feb 25, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 15, 2022Adobe Flash Player Use-After-Free VulnerabilityCVE-2018-15982 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
Product
Flash Player
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Feb 15, 2022Google Chromium Animation Use-After-Free VulnerabilityCVE-2022-0609 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Animation
On CISA’s list since
Feb 15, 2022 (federal fix deadline Mar 1, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Feb 15, 2022Microsoft Internet Explorer Type Confusion VulnerabilityCVE-2019-0752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer
Product
Internet Explorer
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Feb 11, 2022Apple iOS, iPadOS, and macOS Webkit Use-After-Free VulnerabilityCVE-2022-22620 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Feb 11, 2022 (federal fix deadline Feb 25, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.gentoo.org support.apple.com
Feb 10, 2022Microsoft SMBv3 Remote Code Execution VulnerabilityCVE-2020-0796 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 10
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Product
SMBv3
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022Microsoft Windows Shell (.lnk) Remote Code Execution VulnerabilityCVE-2017-8464 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
Product
Windows
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 10, 2022Oracle Corporation WebLogic Server Remote Code Execution VulnerabilityCVE-2017-10271 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedRansomwareHigh 7.5
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Product
WebLogic Server
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Feb 10, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-0262 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office.
Product
Office
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Feb 10, 2022Microsoft SMBv1 Remote Code Execution VulnerabilityCVE-2017-0145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022Microsoft SMBv1 Remote Code Execution VulnerabilityCVE-2017-0144 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Feb 10, 2022D-Link DIR-645 Router Remote Code Execution VulnerabilityCVE-2015-2051 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Product
DIR-645 Router
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityadvisories.dlink.com securityfocus.com
Feb 10, 2022Microsoft HTTP.sys Remote Code Execution VulnerabilityCVE-2015-1635 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
Product
HTTP.sys
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com osvdb.org
Jan 28, 2022Grandstream Networks UCM6200 Series SQL Injection VulnerabilityCVE-2020-5722 · Other software · Grandstream · reported by vulnreport@tenable.comExploitedCritical 9.8
Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.
Product
UCM6200
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Grandstream’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2014-1776 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
Product
Internet Explorer
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
Jan 18, 2022Aviatrix Controller Unrestricted Upload of FileCVE-2021-40870 · Other software · Aviatrix · reported by MITREExploitedCritical 9.8
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Product
Aviatrix Controller
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com docs.aviatrix.com
Jan 18, 2022Microsoft Exchange Server Information DisclosureCVE-2021-33766 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Product
Exchange Server
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Jan 18, 2022VMware Server Side Request Forgery in vRealize Operations Manager APICVE-2021-21975 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 7.5
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Product
vRealize Operations Manager API
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Jan 18, 2022Drupal core Un-restricted Upload of FileCVE-2020-13671 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedHigh 8.8
Improper sanitization in the extension file names is present in Drupal core.
Product
Drupal core
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Jan 10, 2022VMware vCenter Server Improper Access ControlCVE-2021-22017 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Product
vCenter Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Jan 10, 2022Google Chrome Media Use-After-Free VulnerabilityCVE-2020-6572 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Product
Chrome Media
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Jan 10, 2022Microsoft WinVerifyTrust function Remote Code ExecutionCVE-2013-3900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Product
WinVerifyTrust function
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com blogs.technet.com
Jan 10, 2022Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceCVE-2019-9670 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com rapid7.com
Jan 10, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2019-1579 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareHigh 8.1
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Product
PAN-OS
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com devco.re
Jan 10, 2022IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.CVE-2015-7450 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.8
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Product
WebSphere Application Server and Server Hypervisor Edition
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog www-01.ibm.com www-01.ibm.com
Jan 10, 2022Primetek Primefaces Remote Code Execution VulnerabilityCVE-2017-1000486 · Other software · Primetek · reported by MITREExploitedCritical 9.8
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Product
Primefaces Application
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Primetek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.mindedsecurity.com cryptosense.com
Jan 10, 2022FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitCVE-2021-27860 · Other software · FatPipe · reported by cret@cert.orgExploitedCritical 9.8
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Product
WARP, IPVPN, and MPVPN software
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install FatPipe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fatpipeinc.com ic3.gov
Dec 15, 2021Google Chromium V8 Use-After-Free VulnerabilityCVE-2021-4102 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Dec 15, 2021 (federal fix deadline Dec 29, 2021)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Dec 10, 2021MongoDB mongo-express Remote Code Execution VulnerabilityCVE-2019-10758 · Other software · MongoDB · reported by report@snyk.ioExploitedCritical 9.9
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Product
mongo-express
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install MongoDB’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog snyk.io snyk.io
Dec 10, 2021Realtek Jungle SDK Remote Code Execution VulnerabilityCVE-2021-35394 · Network & remote access · Realtek · reported by MITREExploitedCritical 9.8
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Product
Jungle Software Development Kit (SDK)
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog iot-inspector.com realtek.com
Dec 10, 2021Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityCVE-2019-7238 · Other software · Sonatype · reported by MITREExploitedCritical 9.8
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Product
Nexus Repository Manager
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Sonatype’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.sonatype.com support.sonatype.com
Dec 10, 2021Embedthis GoAhead Remote Code Execution VulnerabilityCVE-2017-17562 · Other software · Embedthis · reported by MITREExploitedHigh 8.1
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Product
GoAhead
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Embedthis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securitytracker.com
Dec 10, 2021Red Hat JBoss Application Server Remote Code Execution VulnerabilityCVE-2017-12149 · Other software · Red Hat · reported by Red HatExploitedRansomwareCritical 9.8
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Product
JBoss Application Server
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Dec 10, 2021Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityCVE-2010-1871 · Other software · Red Hat · reported by MITREExploitedHigh 8.8
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
Product
JBoss Seam 2
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com redhat.com
Dec 10, 2021Pi-Hole AdminLTE Remote Code Execution VulnerabilityCVE-2020-8816 · Other software · Pi-hole · reported by MITREExploitedHigh 7.2
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Product
AdminLTE
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Pi-hole’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 10, 2021Apache Log4j2 Remote Code Execution VulnerabilityCVE-2021-44228 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 10
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Product
Log4j2
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.