Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

678 results · page 8 of 14

May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-4123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com secunia.com
May 25, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2014-2817 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 25, 2022Microsoft IME Japanese Privilege Escalation VulnerabilityCVE-2014-4077 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.
Product
Input Method Editor (IME) Japanese
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com securitytracker.com
May 25, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2013-7331 · Computers, phones & browsers · Microsoft · reported by MITREExploitedMedium 6.5
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
Product
Internet Explorer
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fireeye.com kb.cert.org
May 25, 2022IBM InfoSphere BigInsights Invalid Input VulnerabilityCVE-2013-3993 · Other software · IBM · reported by psirt@us.ibm.comExploitedRansomwareMedium 6.5
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Product
InfoSphere BigInsights
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install IBM’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog secunia.com www-01.ibm.com
May 25, 2022Microsoft Silverlight Information Disclosure VulnerabilityCVE-2013-3896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Microsoft Silverlight Double Dereference VulnerabilityCVE-2013-0074 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.
Product
Silverlight
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog us-cert.gov docs.microsoft.com
May 25, 2022Red Hat JBoss Information Disclosure VulnerabilityCVE-2010-1428 · Other software · Red Hat · reported by Red HatExploitedRansomwareHigh 7.5
Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
May 25, 2022Red Hat JBoss Authentication Bypass VulnerabilityCVE-2010-0738 · Other software · Red Hat · reported by Red HatExploitedRansomwareMedium 5.3
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Product
JBoss
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info public.support.unisys.com
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19943 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareHigh 8
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022Apple iOS Information Disclosure VulnerabilityCVE-2016-4655 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com lists.apple.com
May 24, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2018-8611 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 24, 2022QNAP NAS File Station Cross-Site Scripting VulnerabilityCVE-2018-19953 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareMedium 6.1
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 24, 2022Microsoft Windows SMBv1 Information Disclosure VulnerabilityCVE-2017-0147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
Product
SMBv1 server
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 24, 2022Microsoft XML Core Services Information Disclosure VulnerabilityCVE-2017-0022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
Product
XML Core Services
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCVE-2017-0005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2017-0149 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Privilege Escalation VulnerabilityCVE-2017-0210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Artifex Ghostscript Type Confusion VulnerabilityCVE-2017-8291 · Other software · Artifex · reported by MITREExploitedHigh 7.8
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Product
Ghostscript
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Artifex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com debian.org
May 24, 2022Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2017-8543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2016-0162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 4.3
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityCVE-2016-3351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.5
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
Product
Internet Explorer and Edge
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Apple iOS Memory Corruption VulnerabilityCVE-2016-4656 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Apple iOS Webkit Memory Corruption VulnerabilityCVE-2016-4657 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Product
iOS
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apple.com securityfocus.com
May 24, 2022Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityCVE-2016-3298 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Microsoft Update Notification Manager Privilege Escalation VulnerabilityCVE-2020-0638 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Product
Update Notification Manager
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Apple iOS Memory Corruption VulnerabilityCVE-2019-7287 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
Product
iOS
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
May 23, 2022Microsoft Windows AppX Deployment Service Privilege Escalation VulnerabilityCVE-2019-1130 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Cisco IOS XR Open Port VulnerabilityCVE-2022-20821 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Product
IOS XR
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
May 23, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2020-1027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
May 23, 2022Microsoft Internet Explorer Information Disclosure VulnerabilityCVE-2019-0676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Product
Internet Explorer
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
May 23, 2022Microsoft Windows SMB Information Disclosure VulnerabilityCVE-2019-0703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2019-0880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 23, 2022WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Product
WhatsApp
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com facebook.com
May 23, 2022Microsoft Windows AppX Deployment Extensions Privilege Escalation VulnerabilityCVE-2019-1385 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
Product
Windows
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com zerodayinitiative.com
May 23, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2018-8589 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
Product
Win32k
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 16, 2022Zyxel Multiple Firewalls OS Command Injection VulnerabilityCVE-2022-30525 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Product
Multiple Firewalls
On CISA’s list since
May 16, 2022 (federal fix deadline Jun 6, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 4, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2014-4113 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Product
Win32k
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com blogs.technet.com
May 4, 2022Microsoft Internet Explorer Use-After-Free VulnerabilityCVE-2014-0322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
Product
Internet Explorer
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.websense.com technet.microsoft.com
May 4, 2022OpenSSL Information Disclosure VulnerabilityCVE-2014-0160 · Websites & servers · OpenSSL · reported by Red HatExploitedHigh 7.5
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Product
OpenSSL
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install OpenSSL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org blog.fox-it.com
Apr 25, 2022Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCVE-2022-26904 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 25, 2022Microsoft Windows User Profile Service Privilege Escalation VulnerabilityCVE-2022-21919 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Apr 25, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2021-41357 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Product
Win32k
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 25, 2022Microsoft Win32k Privilege Escalation VulnerabilityCVE-2021-40450 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Product
Win32k
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 19, 2022Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2018-6882 · Email & office · Synacor · reported by MITREExploitedRansomwareMedium 6.1
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org securityfocus.com
Apr 19, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-22718 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.
Product
Windows
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 15, 2022Ubiquiti AirOS Command Injection VulnerabilityCVE-2010-5330 · Network & remote access · Ubiquiti · reported by MITREExploitedCritical 9.8
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Product
AirOS
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ubnt.com exploit-db.com
Apr 13, 2022Microsoft Windows CLFS Driver Privilege Escalation VulnerabilityCVE-2022-24521 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 13, 2022Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2015-2502 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
Product
Internet Explorer
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twitter.com twitter.com
Apr 11, 2022Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVE-2021-42278 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Product
Active Directory
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.