Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

638 results · page 9 of 13

May 23, 2022Mozilla Firefox and Thunderbird Sandbox Escape VulnerabilityCVE-2019-11708 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedCritical 10
Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
Product
Firefox and Thunderbird
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bugzilla.mozilla.org
May 16, 2022Zyxel Multiple Firewalls OS Command Injection VulnerabilityCVE-2022-30525 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Product
Multiple Firewalls
On CISA’s list since
May 16, 2022 (federal fix deadline Jun 6, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 16, 2022VMware Spring Cloud Gateway Code Injection VulnerabilityCVE-2022-22947 · Other software · VMware · reported by security@vmware.comExploitedCritical 10
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
Product
Spring Cloud Gateway
On CISA’s list since
May 16, 2022 (federal fix deadline Jun 6, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
May 10, 2022F5 BIG-IP Missing Authentication VulnerabilityCVE-2022-1388 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
Product
BIG-IP
On CISA’s list since
May 10, 2022 (federal fix deadline May 31, 2022)
What to do
Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 25, 2022Jenkins Script Security Plugin Sandbox Bypass VulnerabilityCVE-2019-1003029 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedCritical 9.9
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
Product
Script Security Plugin
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Apr 25, 2022WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityCVE-2022-29464 · Other software · WSO2 · reported by MITREExploitedRansomwareCritical 9.8
Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.
Product
Multiple Products
On CISA’s list since
Apr 25, 2022 (federal fix deadline May 16, 2022)
What to do
Attackers are using this now. Install WSO2’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Apr 19, 2022WhatsApp VOIP Stack Buffer Overflow VulnerabilityCVE-2019-3568 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedCritical 9.8
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Product
WhatsApp
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com facebook.com
Apr 15, 2022Crestron Multiple Products Command Injection VulnerabilityCVE-2019-3929 · Other software · Crestron · reported by vulnreport@tenable.comExploitedCritical 9.8
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Product
Multiple Products
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Crestron’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 15, 2022Alcatel OmniPCX Enterprise Remote Code Execution VulnerabilityCVE-2007-3010 · Other software · Alcatel · reported by MITREExploitedCritical 9.8
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
Product
OmniPCX Enterprise
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Alcatel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info osvdb.org
Apr 15, 2022InduSoft Web Studio NTWebServer Directory Traversal VulnerabilityCVE-2014-0780 · Other software · InduSoft · reported by ics-cert@hq.dhs.govExploitedCritical 9.8
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
Product
Web Studio
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install InduSoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog download.indusoft.com securityfocus.com
Apr 15, 2022Schneider Electric U.motion Builder SQL Injection VulnerabilityCVE-2018-7841 · Other software · Schneider Electric · reported by cybersecurity@se.comExploitedCritical 9.8
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
Product
U.motion Builder
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Schneider Electric’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Apr 15, 2022Ubiquiti AirOS Command Injection VulnerabilityCVE-2010-5330 · Network & remote access · Ubiquiti · reported by MITREExploitedCritical 9.8
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Product
AirOS
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ubnt.com exploit-db.com
Apr 15, 2022D-Link DNS-320 Remote Code Execution VulnerabilityCVE-2019-16057 · Network & remote access · D-Link · reported by MITREExploitedRansomwareCritical 9.8
The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
Product
DNS-320 Storage Device
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install D-Link’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.cystack.net ftc.gov
Apr 14, 2022VMware Workspace ONE Access and Identity Manager Server-Side Template Injection VulnerabilityCVE-2022-22954 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Product
Workspace ONE Access and Identity Manager
On CISA’s list since
Apr 14, 2022 (federal fix deadline May 5, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Apr 13, 2022Adobe Flash Player Use-After-Free VulnerabilityCVE-2015-0313 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
Product
Flash Player
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Apr 13, 2022Adobe Flash Player Remote Code Execution VulnerabilityCVE-2015-0311 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
Product
Flash Player
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Apr 13, 2022Drupal Core Remote Code Execution VulnerabilityCVE-2018-7602 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedRansomwareCritical 9.8
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Product
Core
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Drupal’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Apr 13, 2022Kaseya VSA Remote Code Execution VulnerabilityCVE-2018-20753 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 9.8
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
Product
Virtual System/Server Administrator (VSA)
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.huntresslabs.com helpdesk.kaseya.com
Apr 13, 2022Adobe Flash Player Use-After-Free VulnerabilityCVE-2015-5123 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Product
Flash Player
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com lists.opensuse.org
Apr 13, 2022Adobe Flash Player Use-After-Free VulnerabilityCVE-2015-5122 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Product
Flash Player
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Apr 13, 2022Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityCVE-2015-3113 · Other software · Adobe · reported by AdobeExploitedCritical 9.8
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Product
Flash Player
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Apr 11, 2022QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityCVE-2020-2509 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedCritical 9.8
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Product
QNAP Network-Attached Storage (NAS)
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install QNAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Apr 11, 2022Checkbox Survey Deserialization of Untrusted Data VulnerabilityCVE-2021-27852 · Other software · Checkbox · reported by cret@cert.orgExploitedCritical 9.8
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
Product
Checkbox Survey
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Checkbox’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog kb.cert.org kb.cert.org
Apr 11, 2022Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityCVE-2017-11317 · Other software · Telerik · reported by MITREExploitedCritical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Product
User Interface (UI) for ASP.NET AJAX
On CISA’s list since
Apr 11, 2022 (federal fix deadline May 2, 2022)
What to do
Attackers are using this now. Install Telerik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com telerik.com
Apr 6, 2022Microsoft HTTP Protocol Stack Remote Code Execution VulnerabilityCVE-2021-31166 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Product
HTTP Protocol Stack
On CISA’s list since
Apr 6, 2022 (federal fix deadline Apr 27, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Apr 4, 2022Spring Framework JDK 9+ Remote Code Execution VulnerabilityCVE-2022-22965 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Product
Spring Framework
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 4, 2022D-Link Multiple Routers Remote Code Execution VulnerabilityCVE-2021-45382 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Product
Multiple Routers
On CISA’s list since
Apr 4, 2022 (federal fix deadline Apr 25, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Mar 31, 2022Dasan GPON Routers Authentication Bypass VulnerabilityCVE-2018-10561 · Other software · Dasan · reported by MITREExploitedCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 31, 2022Dasan GPON Routers Command Injection VulnerabilityCVE-2018-10562 · Other software · Dasan · reported by MITREExploitedRansomwareCritical 9.8
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Product
Gigabit Passive Optical Network (GPON) Routers
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dasan’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 31, 2022Sophos Firewall Authentication Bypass VulnerabilityCVE-2022-1040 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Product
Firewall
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com exploit-db.com
Mar 31, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Mar 31, 2022QNAP NAS Improper Authorization VulnerabilityCVE-2021-28799 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Product
Network Attached Storage (NAS)
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 28, 2022Oracle Java SE Sandbox Bypass VulnerabilityCVE-2012-5076 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Debian-specific Redis Server Lua Sandbox Escape VulnerabilityCVE-2022-0543 · Other software · Redis · reported by security@debian.orgExploitedCritical 10
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Product
Debian-specific Redis Servers
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Redis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bugs.debian.org
Mar 28, 2022Oracle Java SE Unspecified VulnerabilityCVE-2013-2465 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org h20000.www2.hp.com
Mar 28, 2022Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityCVE-2013-2729 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
Product
Reader and Acrobat
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022SonicWall Secure Remote Access (SRA) SQL Injection VulnerabilityCVE-2021-20028 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Product
Secure Remote Access (SRA)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Mar 25, 2022Cisco IOS and IOS XE Remote Code Execution VulnerabilityCVE-2017-3881 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
Product
IOS and IOS XE
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securityfocus.com
Mar 25, 2022Citrix ShareFile Improper Access Control VulnerabilityCVE-2021-22941 · Network & remote access · Citrix · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Product
ShareFile
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Mar 25, 2022Citrix Multiple Products Remote Code Execution VulnerabilityCVE-2017-6316 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Product
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCVE-2022-26318 · Network & remote access · WatchGuard · reported by MITREExploitedCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Product
Firebox and XTM Appliances
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog watchguard.com watchguard.com
Mar 25, 2022MiCollab, MiVoice Business Express Access Control VulnerabilityCVE-2022-26143 · Email & office · Mitel · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
Product
MiCollab, MiVoice Business Express
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Mitel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arstechnica.com blog.cloudflare.com
Mar 25, 2022Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Mar 25, 2022Zyxel Multiple NAS Devices OS Command Injection VulnerabilityCVE-2020-9054 · Network & remote access · Zyxel · reported by cret@cert.orgExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org kb.cert.org
Mar 25, 2022OpenSMTPD Remote Code Execution VulnerabilityCVE-2020-7247 · Other software · OpenBSD · reported by MITREExploitedCritical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
Product
OpenSMTPD
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install OpenBSD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Sophos SG UTM Remote Code Execution VulnerabilityCVE-2020-25223 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
Product
SG UTM
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com community.sophos.com
Mar 25, 2022Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2020-2021 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Product
PAN-OS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com security.paloaltonetworks.com
Mar 25, 2022D-Link Multiple Routers Command Injection VulnerabilityCVE-2019-16920 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Product
Multiple Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com medium.com
Mar 25, 2022Webmin Command Injection VulnerabilityCVE-2019-15107 · Other software · Webmin · reported by MITREExploitedRansomwareCritical 9.8
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
Product
Webmin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Webmin’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Citrix SD-WAN and NetScaler SQL Injection VulnerabilityCVE-2019-12989 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.