Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

213 results · page 3 of 5

Dec 3, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSend · reported by VulnCheckExploitedCritical 9.8
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Product
ProjectSend
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Dec 3, 2024North Grid Proself Improper Restriction of XML External Entity (XXE) Reference VulnerabilityCVE-2023-45727 · Other software · North Grid · reported by vultures@jpcert.or.jpExploitedHigh 7.5
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
Product
Proself
On CISA’s list since
Dec 3, 2024 (federal fix deadline Dec 24, 2024)
What to do
Attackers are using this now. Install North Grid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp proself.jp
Oct 23, 2024Fortinet FortiManager Missing Authentication VulnerabilityCVE-2024-47575 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Product
FortiManager
On CISA’s list since
Oct 23, 2024 (federal fix deadline Nov 13, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Oct 3, 2024Synacor Zimbra Collaboration Suite (ZCS) Command Execution VulnerabilityCVE-2024-45519 · Email & office · Synacor · reported by MITREExploitedCritical 10
Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 3, 2024 (federal fix deadline Oct 24, 2024)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Sep 18, 2024Apache HugeGraph-Server Improper Access Control VulnerabilityCVE-2024-27348 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Product
HugeGraph-Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com hugegraph.apache.org
Sep 10, 2024Microsoft Windows Installer Improper Privilege Management VulnerabilityCVE-2024-38014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Sep 9, 2024SonicWall SonicOS Improper Access Control VulnerabilityCVE-2024-40766 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Product
SonicOS
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
Sep 9, 2024ImageMagick Improper Input Validation VulnerabilityCVE-2016-3714 · Other software · ImageMagick · reported by Red HatExploitedHigh 8.4
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
Product
ImageMagick
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install ImageMagick’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.imagemagick.org lists.opensuse.org
Aug 28, 2024Google Chromium V8 Inappropriate Implementation VulnerabilityCVE-2024-7965 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Aug 28, 2024 (federal fix deadline Sep 18, 2024)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com issues.chromium.org
Jul 29, 2024ServiceNow Improper Input Validation VulnerabilityCVE-2024-4879 · Other software · ServiceNow · reported by psirt@servicenow.comExploitedCritical 9.3
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.
Product
Utah, Vancouver, and Washington DC Now Platform
On CISA’s list since
Jul 29, 2024 (federal fix deadline Aug 19, 2024)
What to do
Attackers are using this now. Install ServiceNow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.servicenow.com support.servicenow.com
Jul 17, 2024Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityCVE-2024-34102 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com vicarius.io
Jul 9, 2024Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCVE-2024-23692 · Other software · Rejetto · reported by VulnCheckExploitedRansomwareCritical 9.8
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
Product
HTTP File Server
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Rejetto’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com mohemiv.com
Jun 13, 2024Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityCVE-2024-26169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 23, 2024Apache Flink Improper Access Control VulnerabilityCVE-2020-17519 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
Product
Flink
On CISA’s list since
May 23, 2024 (federal fix deadline Jun 13, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Product
GitLab CE/EE
On CISA’s list since
May 1, 2024 (federal fix deadline May 22, 2024)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Jan 8, 2024Joomla! Improper Access Control VulnerabilityCVE-2023-23752 · Websites & servers · Joomla! · reported by security@joomla.orgExploitedMedium 5.3
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
Product
Joomla!
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Joomla!’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.joomla.org developer.joomla.org
Nov 7, 2023Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityCVE-2023-22518 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.
Product
Confluence Data Center and Server
On CISA’s list since
Nov 7, 2023 (federal fix deadline Nov 28, 2023)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com confluence.atlassian.com
Sep 25, 2023Apple Multiple Products Improper Certificate Validation VulnerabilityCVE-2023-41991 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Product
Multiple Products
On CISA’s list since
Sep 25, 2023 (federal fix deadline Oct 16, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Sep 18, 2023Realtek SDK Improper Input Validation VulnerabilityCVE-2014-8361 · Network & remote access · Realtek · reported by MITREExploitedCritical 9.8
Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.
Product
SDK
On CISA’s list since
Sep 18, 2023 (federal fix deadline Oct 9, 2023)
What to do
Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp jvn.jp
Sep 11, 2023Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow VulnerabilityCVE-2023-41064 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 11, 2023 (federal fix deadline Oct 2, 2023)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com support.apple.com
Aug 24, 2023Ignite Realtime Openfire Path Traversal VulnerabilityCVE-2023-32315 · Other software · Ignite Realtime · reported by GitHubExploitedHigh 8.6
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Product
Openfire
On CISA’s list since
Aug 24, 2023 (federal fix deadline Sep 14, 2023)
What to do
Attackers are using this now. Install Ignite Realtime’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Aug 16, 2023Citrix Content Collaboration ShareFile Improper Access Control VulnerabilityCVE-2023-24489 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Product
Content Collaboration
On CISA’s list since
Aug 16, 2023 (federal fix deadline Sep 6, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Jul 27, 2023Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2023-37580 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jul 27, 2023 (federal fix deadline Aug 17, 2023)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com wiki.zimbra.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-38205 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-29298 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jun 29, 2023Samsung Mobile Devices Improper Input Validation VulnerabilityCVE-2021-25489 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedLow 3.3
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Improper Boundary Check VulnerabilityCVE-2021-25372 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
Product
Email Security Gateway (ESG) Appliance
On CISA’s list since
May 26, 2023 (federal fix deadline Jun 16, 2023)
What to do
Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog status.barracuda.com barracuda.com
May 12, 2023Linux Kernel Improper Input Validation VulnerabilityCVE-2010-3904 · Computers, phones & browsers · Linux · reported by security@ubuntu.comExploitedHigh 7.8
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Product
Kernel
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org lists.opensuse.org
Apr 21, 2023PaperCut MF/NG Improper Access Control VulnerabilityCVE-2023-27350 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareCritical 9.8
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
Product
MF/NG
On CISA’s list since
Apr 21, 2023 (federal fix deadline May 12, 2023)
What to do
Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 7, 2023Veritas Backup Exec Agent Improper Authentication VulnerabilityCVE-2021-27877 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.2
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
Product
Backup Exec Agent
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com veritas.com
Apr 3, 2023Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2022-27926 · Email & office · Synacor · reported by MITREExploitedMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Apr 3, 2023 (federal fix deadline Apr 24, 2023)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25337 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25369 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.2
Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Oct 20, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-41352 · Email & office · Synacor · reported by MITREExploitedRansomwareCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Oct 20, 2022 (federal fix deadline Nov 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.zimbra.org
Sep 15, 2022Trend Micro Apex One and Apex One as a Service Improper Validation VulnerabilityCVE-2022-40139 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.2
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
Product
Apex One and Apex One as a Service
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Sep 15, 2022Linux Kernel Improper Input Validation VulnerabilityCVE-2013-6282 · Computers, phones & browsers · Linux · reported by MITREExploitedHigh 8.8
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Product
Kernel
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org codeaurora.org
Sep 8, 2022Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityCVE-2018-13374 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 4.3
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Product
FortiOS and FortiADC
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Aug 25, 2022Delta Electronics DOPSoft 2 Improper Input Validation VulnerabilityCVE-2021-38406 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govExploitedHigh 7.8
Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.
Product
DOPSoft 2
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install Delta Electronics’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.cisa.gov us-cert.cisa.gov
Aug 25, 2022PEAR Archive_Tar Improper Link Resolution VulnerabilityCVE-2020-36193 · Other software · PEAR · reported by MITREExploitedHigh 7.5
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
Product
Archive_Tar
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install PEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com lists.debian.org
Aug 18, 2022Microsoft Windows Runtime Remote Code Execution VulnerabilityCVE-2022-21971 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Aug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass VulnerabilityCVE-2022-37042 · Email & office · Synacor · reported by MITREExploitedRansomwareCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Aug 11, 2022Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityCVE-2022-27925 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.2
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 11, 2022 (federal fix deadline Sep 1, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com wiki.zimbra.com
Aug 4, 2022Synacor Zimbra Collaboration Suite (ZCS) Command Injection VulnerabilityCVE-2022-27924 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 4, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Jul 12, 2022Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation VulnerabilityCVE-2022-22047 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
Product
Windows
On CISA’s list since
Jul 12, 2022 (federal fix deadline Aug 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 8, 2022QNAP QTS Improper Input Validation VulnerabilityCVE-2019-7193 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
Product
QTS
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com qnap.com
Jun 8, 2022QNAP Photo Station Improper Access Control VulnerabilityCVE-2019-7192 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
Product
Photo Station
On CISA’s list since
Jun 8, 2022 (federal fix deadline Jun 22, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com qnap.com
May 25, 2022Microsoft Silverlight Runtime Remote Code Execution VulnerabilityCVE-2016-0034 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
May 25, 2022Microsoft IME Japanese Privilege Escalation VulnerabilityCVE-2014-4077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
Product
Input Method Editor (IME) Japanese
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com securitytracker.com
May 25, 2022Oracle JRE Unspecified VulnerabilityCVE-2013-2423 · Other software · Oracle · reported by secalert_us@oracle.comExploitedLow 3.7
Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.
Product
Java Runtime Environment (JRE)
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.fuseyism.com blog.spiderlabs.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.