Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

69 results · page 1 of 2

Oct 20, 2026Plex Media Server External Control of File Name or Path VulnerabilityCVE-2026-96656 · Other software · Plex · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.6
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Product
Media Server
On CISA’s list since
Oct 20, 2026 (federal fix deadline Oct 23, 2026)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.plex.tv raw.githubusercontent.com
Oct 20, 2026Siemens Software Center Uncontrolled Search Path Element VulnerabilityCVE-2026-110936 · Other software · Siemens · reported by productcert@siemens.comExploitedHigh 8.4
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Product
Software Center
On CISA’s list since
Oct 20, 2026 (federal fix deadline Nov 3, 2026)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert-portal.siemens.com productcert.siemens.com
Oct 8, 2026ProFTPD Improper Access Control VulnerabilityCVE-2015-3306 · Other software · ProFTPD · reported by MITREExploitedCritical 10
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product
ProFTPD
On CISA’s list since
Oct 8, 2026 (federal fix deadline Oct 11, 2026)
What to do
Attackers are using this now. Install ProFTPD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.fedoraproject.org lists.fedoraproject.org
Sep 9, 2026Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-20079 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
Product
Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
On CISA’s list since
Sep 9, 2026 (federal fix deadline Sep 12, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com seclists.org
Aug 24, 2026Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCVE-2026-21962 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 10
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
Product
HTTP Server and Oracle Weblogic Server Proxy Plug-in
On CISA’s list since
Aug 24, 2026 (federal fix deadline Aug 27, 2026)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com github.com
Jul 21, 2026Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2026-0770 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comExploitedCritical 9.8
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
Product
Langflow
On CISA’s list since
Jul 21, 2026 (federal fix deadline Jul 24, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zerodayinitiative.com cisa.gov
Jul 14, 2026Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability CVE-2026-56155 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Active Directory Federation Services
On CISA’s list since
Jul 14, 2026 (federal fix deadline Jul 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 7, 2026Langflow Authorization Bypass Through User-Controlled Key VulnerabilityCVE-2026-55255 · Other software · Langflow · reported by GitHubExploitedHigh 8.4
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
Product
Langflow
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jul 7, 2026Joomlack Page Builder Improper Access Control VulnerabilityCVE-2026-56290 · Websites & servers · Joomlack · reported by security@joomla.orgExploitedCritical 10
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Product
Page Builder
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install Joomlack’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomlack.fr forum.joomlack.fr
Jun 23, 2026Ubiquiti UniFi OS Improper Access Control VulnerabilityCVE-2026-34908 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
Product
UniFi OS
On CISA’s list since
Jun 23, 2026 (federal fix deadline Jun 26, 2026)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ui.com cisa.gov
Jun 16, 2026Widget Factory Joomla Content Editor Improper Access Control VulnerabilityCVE-2026-48907 · Other software · Widget Factory · reported by security@joomla.orgExploitedCritical 10
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
Product
Joomla Content Editor
On CISA’s list since
Jun 16, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install Widget Factory’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomlacontenteditor.net cisa.gov
Jun 5, 2026SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilityCVE-2026-28318 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 7.5
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Product
Serv-U
On CISA’s list since
Jun 5, 2026 (federal fix deadline Jun 19, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
May 14, 2026Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCVE-2026-20182 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
Product
Catalyst SD-WAN
On CISA’s list since
May 14, 2026 (federal fix deadline May 17, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Apr 22, 2026Microsoft Defender Insufficient Granularity of Access Control VulnerabilityCVE-2026-33825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Product
Defender
On CISA’s list since
Apr 22, 2026 (federal fix deadline May 6, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Apr 6, 2026Fortinet FortiClient EMS Improper Access Control VulnerabilityCVE-2026-35616 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Product
FortiClient EMS
On CISA’s list since
Apr 6, 2026 (federal fix deadline Apr 9, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Mar 19, 2026Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityCVE-2026-20131 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareCritical 10
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
Product
Secure Firewall Management Center (FMC)
On CISA’s list since
Mar 19, 2026 (federal fix deadline Mar 22, 2026)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com aws.amazon.com
Mar 11, 2026n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCVE-2025-68613 · Other software · n8n · reported by GitHubExploitedCritical 9.9
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Product
n8n
On CISA’s list since
Mar 11, 2026 (federal fix deadline Mar 25, 2026)
What to do
Attackers are using this now. Install n8n’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 25, 2026Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCVE-2026-20127 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
Product
Catalyst SD-WAN Controller and Manager
On CISA’s list since
Feb 25, 2026 (federal fix deadline Feb 27, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.8
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com isc.sans.org
Feb 12, 2026SolarWinds Web Help Desk Security Control Bypass VulnerabilityCVE-2025-40536 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedHigh 8.1
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
Product
Web Help Desk
On CISA’s list since
Feb 12, 2026 (federal fix deadline Feb 15, 2026)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Jan 22, 2026Vite Vitejs Improper Access Control VulnerabilityCVE-2025-31125 · Other software · Vite · reported by GitHubExploitedMedium 5.3
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Product
Vitejs
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Vite’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Nov 12, 2025Gladinet Triofox Improper Access Control VulnerabilityCVE-2025-12480 · Other software · Gladinet · reported by mandiant-cve@google.comExploitedCritical 9.1
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
Product
Triofox
On CISA’s list since
Nov 12, 2025 (federal fix deadline Dec 3, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog access.triofox.com cloud.google.com
Nov 4, 2025CWP Control Web Panel OS Command Injection VulnerabilityCVE-2025-48703 · Other software · CWP · reported by MITREExploitedCritical 9
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Product
Control Web Panel
On CISA’s list since
Nov 4, 2025 (federal fix deadline Nov 25, 2025)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fenrisk.com control-webpanel.com
Oct 20, 2025Microsoft Windows SMB Client Improper Access Control VulnerabilityCVE-2025-33073 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
Product
Windows
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Oct 14, 2025Microsoft Windows Improper Access Control VulnerabilityCVE-2025-59230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Oct 14, 2025 (federal fix deadline Nov 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Sep 29, 2025Sudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2025-32463 · Other software · Sudo · reported by MITREExploitedCritical 9.3
Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.
Product
Sudo
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Sudo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog access.redhat.com bugs.gentoo.org
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
Product
TM SGNL
On CISA’s list since
Jul 1, 2025 (federal fix deadline Jul 22, 2025)
What to do
Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wired.com cisa.gov
Jun 10, 2025 Microsoft Windows External Control of File Name or Path VulnerabilityCVE-2025-33053 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.
Product
Windows
On CISA’s list since
Jun 10, 2025 (federal fix deadline Jul 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com research.checkpoint.com
Jun 2, 2025Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityCVE-2025-35939 · Other software · Craft CMS · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
Product
Craft CMS
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 25, 2025Microsoft Partner Center Improper Access Control VulnerabilityCVE-2024-49035 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.7
Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.
Product
Partner Center
On CISA’s list since
Feb 25, 2025 (federal fix deadline Mar 18, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 21, 2025Microsoft Power Pages Improper Access Control VulnerabilityCVE-2025-24989 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.2
Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
Product
Power Pages
On CISA’s list since
Feb 21, 2025 (federal fix deadline Mar 14, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Feb 6, 2025Dante Discovery Process Control VulnerabilityCVE-2022-23748 · Other software · Audinate · reported by cve@checkpoint.comExploitedHigh 7.8
Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code.
Product
Dante Discovery
On CISA’s list since
Feb 6, 2025 (federal fix deadline Feb 27, 2025)
What to do
Attackers are using this now. Install Audinate’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cpr-zero.checkpoint.com audinate.com
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Product
Controllers
On CISA’s list since
Jan 16, 2025 (federal fix deadline Feb 6, 2025)
What to do
Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.aviatrix.com docs.aviatrix.com
Dec 16, 2024Adobe ColdFusion Improper Access Control VulnerabilityCVE-2024-20767 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.4
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
Product
ColdFusion
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Sep 18, 2024Apache HugeGraph-Server Improper Access Control VulnerabilityCVE-2024-27348 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
Product
HugeGraph-Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com hugegraph.apache.org
Sep 9, 2024SonicWall SonicOS Improper Access Control VulnerabilityCVE-2024-40766 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Product
SonicOS
On CISA’s list since
Sep 9, 2024 (federal fix deadline Sep 30, 2024)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com cisa.gov
May 23, 2024Apache Flink Improper Access Control VulnerabilityCVE-2020-17519 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
Product
Flink
On CISA’s list since
May 23, 2024 (federal fix deadline Jun 13, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
Product
GitLab CE/EE
On CISA’s list since
May 1, 2024 (federal fix deadline May 22, 2024)
What to do
Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gitlab.com hackerone.com
Mar 4, 2024Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control VulnerabilityCVE-2024-21338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Product
Windows
On CISA’s list since
Mar 4, 2024 (federal fix deadline Mar 25, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com decoded.avast.io
Jan 8, 2024Joomla! Improper Access Control VulnerabilityCVE-2023-23752 · Websites & servers · Joomla! · reported by security@joomla.orgExploitedMedium 5.3
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
Product
Joomla!
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Joomla!’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.joomla.org developer.joomla.org
Oct 5, 2023Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityCVE-2023-22515 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
Product
Confluence Data Center and Server
On CISA’s list since
Oct 5, 2023 (federal fix deadline Oct 13, 2023)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com confluence.atlassian.com
Aug 16, 2023Citrix Content Collaboration ShareFile Improper Access Control VulnerabilityCVE-2023-24489 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Product
Content Collaboration
On CISA’s list since
Aug 16, 2023 (federal fix deadline Sep 6, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-38205 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Jul 20, 2023Adobe ColdFusion Improper Access Control VulnerabilityCVE-2023-29298 · Websites & servers · Adobe · reported by AdobeExploitedHigh 7.5
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.
Product
ColdFusion
On CISA’s list since
Jul 20, 2023 (federal fix deadline Aug 10, 2023)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Apr 21, 2023PaperCut MF/NG Improper Access Control VulnerabilityCVE-2023-27350 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareCritical 9.8
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
Product
MF/NG
On CISA’s list since
Apr 21, 2023 (federal fix deadline May 12, 2023)
What to do
Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 17, 2023CWP Control Web Panel OS Command Injection VulnerabilityCVE-2022-44877 · Other software · CWP · reported by MITREExploitedCritical 9.8
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Product
Control Web Panel
On CISA’s list since
Jan 17, 2023 (federal fix deadline Feb 7, 2023)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 13, 2022Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCVE-2022-27518 · Network & remote access · Citrix · reported by secure@citrix.comExploitedCritical 9.8
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Product
Application Delivery Controller (ADC) and Gateway
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25337 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25369 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.2
Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Oct 24, 2022Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCVE-2020-3153 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareMedium 6.5
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
Product
AnyConnect Secure
On CISA’s list since
Oct 24, 2022 (federal fix deadline Nov 14, 2022)
What to do
Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.