Vulnerability database

6 results

• Feb 12, 2026Microsoft Configuration Manager SQL Injection VulnerabilityCVE-2024-43468 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8

  Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

  Product

  Configuration Manager

  On CISA’s list since

  Feb 12, 2026 (federal fix deadline Mar 5, 2026)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov

• Oct 31, 2023F5 BIG-IP Configuration Utility SQL Injection VulnerabilityCVE-2023-46748 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedHigh 8.8

  F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

  Product

  BIG-IP Configuration Utility

  On CISA’s list since

  Oct 31, 2023 (federal fix deadline Nov 21, 2023)

  What to do

  Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmy.f5.comsecpod.com

• Oct 31, 2023F5 BIG-IP Configuration Utility Authentication Bypass VulnerabilityCVE-2023-46747 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8

  F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

  Product

  BIG-IP Configuration Utility

  On CISA’s list since

  Oct 31, 2023 (federal fix deadline Nov 21, 2023)

  What to do

  Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.commy.f5.com

• Mar 25, 2022VMware Tanzu Spring Cloud Config Directory Traversal VulnerabilityCVE-2020-5410 · Other software · VMware Tanzu · reported by security@pivotal.ioExploitedHigh 7.5

  Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.

  Product

  Spring Cloud Configuration (Config) Server

  On CISA’s list since

  Mar 25, 2022 (federal fix deadline Apr 15, 2022)

  What to do

  Attackers are using this now. Install VMware Tanzu’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogtanzu.vmware.comtanzu.vmware.com

• Jan 10, 2022FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitCVE-2021-27860 · Other software · FatPipe · reported by cret@cert.orgExploitedCritical 9.8

  A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

  Product

  WARP, IPVPN, and MPVPN software

  On CISA’s list since

  Jan 10, 2022 (federal fix deadline Jan 24, 2022)

  What to do

  Attackers are using this now. Install FatPipe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfatpipeinc.comic3.gov

• Nov 3, 2021Fortinet FortiOS Default Configuration VulnerabilityCVE-2019-5591 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareMedium 6.5

  Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.

  Product

  FortiOS

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfortiguard.comfortiguard.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.