Vulnerability database

4 results

• Jul 22, 2026Check Point SmartConsole Improper Authentication VulnerabilityCVE-2026-16232 · Network & remote access · Check Point · reported by cve@checkpoint.comExploitedCritical 9.3

  Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

  Product

  SmartConsole

  On CISA’s list since

  Jul 22, 2026 (federal fix deadline Jul 25, 2026)

  What to do

  Attackers are using this now. Install Check Point’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsupport.checkpoint.comcisa.gov

• May 27, 2026Nx Console Embedded Malicious Code VulnerabilityCVE-2026-48027 · Other software · Nx · reported by GitHubExploitedRansomwareCritical 9.3

  Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.

  Product

  Nx Console

  On CISA’s list since

  May 27, 2026 (federal fix deadline Jun 10, 2026)

  What to do

  Attackers are using this now. Install Nx’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Mar 11, 2025Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityCVE-2025-26633 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7

  Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.

  Product

  Windows

  On CISA’s list since

  Mar 11, 2025 (federal fix deadline Apr 1, 2025)

  What to do

  Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comvicarius.io

• Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8

  Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.

  Product

  Windows

  On CISA’s list since

  Oct 8, 2024 (federal fix deadline Oct 29, 2024)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.