Updated 13 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

75 results · page 2 of 2

Apr 25, 2022WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityCVE-2022-29464 · Other software · WSO2 · reported by MITREExploitedRansomwareCritical 9.8
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
Product
Multiple Products
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install WSO2’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Apr 11, 2022Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityCVE-2017-11317 · Other software · Telerik · reported by MITREExploitedCritical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Product
User Interface (UI) for ASP.NET AJAX
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Telerik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com telerik.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Mar 31, 2022Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCVE-2021-34484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 28, 2022Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityCVE-2021-26085 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareMedium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Product
Confluence Server
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022Rejetto HTTP File Server (HFS) Remote Code Execution VulnerabilityCVE-2014-6287 · Other software · Rejetto · reported by MITREExploitedCritical 9.8
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
Product
HTTP File Server (HFS)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Rejetto’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 3, 2022Microsoft Office Malformed EPS File VulnerabilityCVE-2015-2545 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.morphisec.com securitytracker.com
Jan 18, 2022Aviatrix Controller Unrestricted Upload of FileCVE-2021-40870 · Other software · Aviatrix · reported by MITREExploitedCritical 9.8
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Product
Aviatrix Controller
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com docs.aviatrix.com
Jan 18, 2022Drupal core Un-restricted Upload of FileCVE-2020-13671 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedHigh 8.8
Improper sanitization in the extension file names is present in Drupal core.
Product
Drupal core
On CISA’s list since
Jan 18, 2022 (federal fix deadline Jul 18, 2022)
What to do
Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Dec 10, 2021Fortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedLow 3.3
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Product
FortiOS
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Nov 3, 2021Oracle Solaris and Zettabyte File System (ZFS) Unspecified VulnerabilityCVE-2020-14871 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 10
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
Product
Solaris and Zettabyte File System (ZFS)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Adobe ColdFusion Unrestricted File Upload VulnerabilityCVE-2018-15961 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
Product
ColdFusion
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021ImageMagick Arbitrary File Deletion VulnerabilityCVE-2016-3715 · Other software · ImageMagick · reported by Red HatExploitedMedium 5.5
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
Product
ImageMagick
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install ImageMagick’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.imagemagick.org lists.opensuse.org
Nov 3, 2021Microsoft Windows Privilege Common Log File System (CLFS) Escalation VulnerabilityCVE-2019-1214 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2021-36955 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Ivanti Pulse Connect Secure Unrestricted File Upload VulnerabilityCVE-2021-22900 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Product
Pulse Connect Secure
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.pulsesecure.net kb.pulsesecure.net
Nov 3, 2021Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityCVE-2019-11510 · Network & remote access · Ivanti · reported by MITREExploitedRansomwareCritical 10
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
Product
Pulse Connect Secure
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Roundcube Webmail File Disclosure VulnerabilityCVE-2017-16651 · Websites & servers · Roundcube · reported by MITREExploitedHigh 7.8
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Product
Roundcube Webmail
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Nov 3, 2021SonicWall Email Security Unrestricted Upload of File VulnerabilityCVE-2021-20022 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareHigh 7.2
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Nov 3, 2021VMware vCenter Server File Upload VulnerabilityCVE-2021-22005 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Nov 3, 2021WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Product
File Manager Plugin
Fixed in
6.9
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Product
Snap Creek Duplicator Plugin
Fixed in
1.3.28
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Zoho ManageEngine Desktop Central File Upload VulnerabilityCVE-2020-10189 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org
Nov 3, 2021Zoho ManageEngine ServiceDesk Plus (SDP) File Upload VulnerabilityCVE-2019-8394 · Email & office · Zoho · reported by MITREExploitedMedium 6.5
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.