Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

27 results

Aug 11, 2026Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2026-68820 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows Ancillary Function Driver for WinSock
On CISA’s list since
Aug 11, 2026 (federal fix deadline Aug 25, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-32701 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVE-2025-32709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
May 13, 2025Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2025-32706 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
May 13, 2025 (federal fix deadline Jun 3, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Apr 8, 2025Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityCVE-2025-29824 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product
Windows
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Mar 11, 2025Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityCVE-2025-24985 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.
Product
Windows
On CISA’s list since
Mar 11, 2025 (federal fix deadline Apr 1, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Feb 11, 2025Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityCVE-2025-21418 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Feb 11, 2025 (federal fix deadline Mar 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Dec 16, 2024Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Dec 10, 2024Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2024-49138 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 10, 2024 (federal fix deadline Dec 31, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstorm.news
Aug 13, 2024Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation VulnerabilityCVE-2024-38193 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Jun 12, 2024Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2024-4610 · Computers, phones & browsers · Arm · reported by arm-security@arm.comExploitedHigh 7.8
Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Product
Mali GPU Kernel Driver
On CISA’s list since
Jun 12, 2024 (federal fix deadline Jul 3, 2024)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Nov 14, 2023Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation VulnerabilityCVE-2023-36036 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Nov 14, 2023 (federal fix deadline Dec 5, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 3, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2023-4211 · Computers, phones & browsers · Arm · reported by arm-security@arm.comExploitedMedium 5.5
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Product
Mali GPU Kernel Driver
On CISA’s list since
Oct 3, 2023 (federal fix deadline Oct 24, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Jul 7, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2021-29256 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Jul 7, 2023 (federal fix deadline Jul 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Apr 11, 2023Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2023-28252 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Apr 11, 2023 (federal fix deadline May 2, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Apr 7, 2023Arm Mali GPU Kernel Driver Information Disclosure VulnerabilityCVE-2023-26083 · Computers, phones & browsers · Arm · reported by MITREExploitedLow 3.3
Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com cybersecurity-help.cz
Mar 30, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2022-38181 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com developer.arm.com
Mar 30, 2023Arm Mali GPU Kernel Driver Unspecified VulnerabilityCVE-2022-22706 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 7.8
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Feb 14, 2023Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2023-23376 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Feb 10, 2023Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityCVE-2015-2291 · Other software · Intel · reported by MITREExploitedRansomwareHigh 7.8
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Product
Ethernet Diagnostics Driver for Windows
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Intel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Sep 15, 2022Code Aurora ACDB Audio Driver Stack-based Buffer Overflow VulnerabilityCVE-2013-2597 · Other software · Code Aurora · reported by MITREExploitedHigh 8.4
The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.
Product
ACDB Audio Driver
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Code Aurora’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog codeaurora.org codeaurora.org
Sep 14, 2022Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2022-37969 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Sep 14, 2022 (federal fix deadline Oct 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Apr 13, 2022Microsoft Windows CLFS Driver Privilege Escalation VulnerabilityCVE-2022-24521 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Apr 13, 2022 (federal fix deadline May 4, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 31, 2022Dell dbutil Driver Insufficient Access Control VulnerabilityCVE-2021-21551 · Other software · Dell · reported by security_alert@emc.comExploitedHigh 8.8
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Product
dbutil Driver
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 28, 2022Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation VulnerabilityCVE-2011-2005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.
Product
Ancillary Function Driver (afd.sys)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.microsoft.com oval.cisecurity.org
Mar 3, 2022Microsoft ATM Font Driver Privilege Escalation VulnerabilityCVE-2015-2387 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.
Product
ATM Font Driver
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2021-36955 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.