Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

572 results · page 7 of 12

Apr 11, 2022Linux Kernel Privilege Escalation VulnerabilityCVE-2021-22600 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comExploitedMedium 6.6
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Product
Kernel
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org lists.debian.org
Apr 11, 2022Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityCVE-2017-11317 · Other software · Telerik · reported by MITREExploitedCritical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Product
User Interface (UI) for ASP.NET AJAX
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Telerik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com telerik.com
Apr 6, 2022Microsoft HTTP Protocol Stack Remote Code Execution VulnerabilityCVE-2021-31166 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Product
HTTP Protocol Stack
On CISA’s list since
Apr 6, 2022 (federal fix deadline Apr 27, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Apr 6, 2022Microsoft SMBv1 Server Remote Code Execution VulnerabilityCVE-2017-0148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.1
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
Product
SMBv1 server
On CISA’s list since
Apr 6, 2022 (federal fix deadline Apr 27, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 4, 2022D-Link Multiple Routers Remote Code Execution VulnerabilityCVE-2021-45382 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Product
Multiple Routers
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Apr 4, 2022Spring Framework JDK 9+ Remote Code Execution VulnerabilityCVE-2022-22965 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Product
Spring Framework
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Mar 28, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2017-0059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Debian-specific Redis Server Lua Sandbox Escape VulnerabilityCVE-2022-0543 · Other software · Redis · reported by security@debian.orgExploitedCritical 10
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Product
Debian-specific Redis Servers
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Redis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bugs.debian.org
Mar 28, 2022Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityCVE-2021-38646 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Edge and Internet Explorer Type Confusion VulnerabilityCVE-2017-0037 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.1
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
Product
Edge and Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2016-0189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft Windows Adobe Type Manager Library Remote Code Execution VulnerabilityCVE-2015-2426 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com kb.cert.org
Mar 28, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securitytracker.com docs.microsoft.com
Mar 28, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2013-2551 · Computers, phones & browsers · Microsoft · reported by MITREExploitedRansomwareHigh 8.8
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.
Product
Internet Explorer
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog h30499.www3.hp.com twitter.com
Mar 28, 2022Mozilla Firefox and Thunderbird Denial-of-Service VulnerabilityCVE-2013-1690 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 8.8
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
Product
Firefox and Thunderbird
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 28, 2022Oracle Java SE Sandbox Bypass VulnerabilityCVE-2012-5076 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Microsoft Word Remote Code Execution VulnerabilityCVE-2012-2539 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.
Product
Word
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
Mar 25, 2022Citrix Multiple Products Remote Code Execution VulnerabilityCVE-2017-6316 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Product
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCVE-2022-26318 · Network & remote access · WatchGuard · reported by MITREExploitedCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Product
Firebox and XTM Appliances
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog watchguard.com watchguard.com
Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Mar 25, 2022Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Mar 25, 2022D-Link DIR-610 Devices Remote Command ExecutionCVE-2020-9377 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
Product
DIR-610 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gist.github.com supportannouncement.us.dlink.com
Mar 25, 2022Zyxel Multiple NAS Devices OS Command Injection VulnerabilityCVE-2020-9054 · Network & remote access · Zyxel · reported by cret@cert.orgExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org kb.cert.org
Mar 25, 2022OpenSMTPD Remote Code Execution VulnerabilityCVE-2020-7247 · Other software · OpenBSD · reported by MITREExploitedCritical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
Product
OpenSMTPD
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install OpenBSD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Sophos SG UTM Remote Code Execution VulnerabilityCVE-2020-25223 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
Product
SG UTM
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com community.sophos.com
Mar 25, 2022Drupal Core Remote Code Execution VulnerabilityCVE-2019-6340 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedHigh 8.1
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Product
Core
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com drupal.org
Mar 25, 2022Oracle BI Publisher Unauthorized Access VulnerabilityCVE-2019-2616 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.2
Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.
Product
BI Publisher (Formerly XML Publisher)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Mar 25, 2022Citrix SD-WAN and NetScaler Command Injection VulnerabilityCVE-2019-12991 · Network & remote access · Citrix · reported by MITREExploitedHigh 8.8
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022Citrix SD-WAN and NetScaler SQL Injection VulnerabilityCVE-2019-12989 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022Kentico Xperience Deserialization of Untrusted Data VulnerabilityCVE-2019-10068 · Other software · Kentico · reported by MITREExploitedCritical 9.8
Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.
Product
Xperience
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com devnet.kentico.com
Mar 25, 2022Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityCVE-2019-1003030 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedCritical 9.9
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
Product
Matrix Project Plugin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022Microsoft GDI Remote Code Execution VulnerabilityCVE-2019-0903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.
Product
Graphics Device Interface (GDI)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 25, 2022Microsoft Windows Shell Remote Code Execution VulnerabilityCVE-2018-8414 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Microsoft Scripting Engine Memory Corruption VulnerabilityCVE-2018-8373 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.
Product
Internet Explorer Scripting Engine
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022LG N1A1 NAS Remote Command Execution VulnerabilityCVE-2018-14839 · Other software · LG · reported by MITREExploitedCritical 9.8
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
Product
N1A1 NAS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install LG’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog medium.com medium.com
Mar 25, 2022Quest KACE System Management Appliance Remote Command Execution VulnerabilityCVE-2018-11138 · Other software · Quest · reported by MITREExploitedRansomwareCritical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Product
KACE System Management Appliance
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Quest’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog coresecurity.com exploit-db.com
Mar 25, 2022Cisco VPN Routers Remote Code Execution VulnerabilityCVE-2018-0125 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.
Product
VPN Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Cisco IOS and IOS XE Remote Code Execution VulnerabilityCVE-2017-3881 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
Product
IOS and IOS XE
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securityfocus.com
Mar 25, 2022Apache Tomcat Remote Code Execution VulnerabilityCVE-2017-12617 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.1
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Product
Tomcat
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Mar 25, 2022Apache Tomcat on Windows Remote Code Execution VulnerabilityCVE-2017-12615 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareHigh 8.1
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Product
Tomcat
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog breaktoprotect.blogspot.com securityfocus.com
Mar 25, 2022Microsoft Windows SMB Remote Code Execution VulnerabilityCVE-2017-0146 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Adobe Flash Player Remote Code Execution VulnerabilityCVE-2016-4171 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Unspecified vulnerability in Adobe Flash Player allows for remote code execution.
Product
Flash Player
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 25, 2022Elasticsearch Groovy Scripting Engine Remote Code Execution VulnerabilityCVE-2015-1427 · Other software · Elastic · reported by MITREExploitedCritical 9.8
The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.
Product
Elasticsearch
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Elastic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022D-Link and TRENDnet Multiple Devices Remote Code Execution VulnerabilityCVE-2015-1187 · Network & remote access · D-Link and TRENDnet · reported by MITREExploitedCritical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
Product
Multiple Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link and TRENDnet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityCVE-2014-6332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Rejetto HTTP File Server (HFS) Remote Code Execution VulnerabilityCVE-2014-6287 · Other software · Rejetto · reported by MITREExploitedCritical 9.8
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
Product
HTTP File Server (HFS)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Rejetto’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.