Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Sep 16, 2026Acronis Backup Incorrect Default Permissions VulnerabilityCVE-2026-87886 · Other software · Acronis · reported by security@acronis.comExploitedHigh 7.8
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
- Product
- Backup
- On CISA’s list since
- Sep 16, 2026 (federal fix deadline Sep 19, 2026)
- What to do
- Attackers are using this now. Install Acronis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsecurity-advisory.acronis.comcisa.gov
Mar 19, 2025NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityCVE-2024-48248 · Other software · NAKIVO · reported by MITREExploitedHigh 8.6
NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
- Product
- Backup and Replication
- On CISA’s list since
- Mar 19, 2025 (federal fix deadline Apr 9, 2025)
- What to do
- Attackers are using this now. Install NAKIVO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloghelpcenter.nakivo.comlabs.watchtowr.com
Oct 17, 2024Veeam Backup and Replication Deserialization VulnerabilityCVE-2024-40711 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
- Product
- Backup & Replication
- On CISA’s list since
- Oct 17, 2024 (federal fix deadline Nov 7, 2024)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comlabs.watchtowr.com
Aug 22, 2023Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityCVE-2023-27532 · Other software · Veeam · reported by support@hackerone.comExploitedRansomwareHigh 7.5
Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.
- Product
- Backup & Replication
- On CISA’s list since
- Aug 22, 2023 (federal fix deadline Sep 12, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Apr 7, 2023Veritas Backup Exec Agent File Access VulnerabilityCVE-2021-27876 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.1
Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
- Product
- Backup Exec Agent
- On CISA’s list since
- Apr 7, 2023 (federal fix deadline Apr 28, 2023)
- What to do
- Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comveritas.com
Apr 7, 2023Veritas Backup Exec Agent Improper Authentication VulnerabilityCVE-2021-27877 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.2
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
- Product
- Backup Exec Agent
- On CISA’s list since
- Apr 7, 2023 (federal fix deadline Apr 28, 2023)
- What to do
- Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comveritas.com
Apr 7, 2023Veritas Backup Exec Agent Command Execution VulnerabilityCVE-2021-27878 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.8
Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
- Product
- Backup Exec Agent
- On CISA’s list since
- Apr 7, 2023 (federal fix deadline Apr 28, 2023)
- What to do
- Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comveritas.com
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26500 · Other software · Veeam · reported by MITREExploitedRansomwareHigh 8.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26501 · Other software · Veeam · reported by MITREExploitedRansomwareCritical 9.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogveeam.comveeam.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.