Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

15 results

Oct 26, 2026PHP Memory Corruption VulnerabilityCVE-2026-109618 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com seclists.org
Oct 26, 2026PHP Stale Internal Request-State VulnerabilityCVE-2026-109619 · Websites & servers · PHP Group · reported by security@php.netExploitedCritical 9.2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Product
PHP
On CISA’s list since
Oct 26, 2026 (federal fix deadline Oct 29, 2026)
What to do
Attackers are using this now. Install PHP Group’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com openwall.com
Jan 22, 2026Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion VulnerabilityCVE-2025-68645 · Email & office · Synacor · reported by MITREExploitedHigh 8.8
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Jul 7, 2025PHPMailer Command Injection VulnerabilityCVE-2016-10033 · Websites & servers · PHP · reported by MITREExploitedCritical 9.8
PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Product
PHPMailer
On CISA’s list since
Jul 7, 2025 (federal fix deadline Jul 28, 2025)
What to do
Attackers are using this now. Install PHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jun 12, 2024PHP-CGI OS Command Injection VulnerabilityCVE-2024-4577 · Websites & servers · PHP Group · reported by security@php.netExploitedRansomwareCritical 9.8
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Product
PHP
On CISA’s list since
Jun 12, 2024 (federal fix deadline Jul 3, 2024)
What to do
Attackers are using this now. Install PHP Group’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com arstechnica.com
Nov 13, 2023Juniper Junos OS EX Series PHP External Variable Modification VulnerabilityCVE-2023-36844 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedMedium 5.3
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com supportportal.juniper.net
Nov 13, 2023Juniper Junos OS EX Series and SRX Series PHP External Variable Modification VulnerabilityCVE-2023-36845 · Network & remote access · Juniper · reported by sirt@juniper.netExploitedCritical 9.8
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
Product
Junos OS
On CISA’s list since
Nov 13, 2023 (federal fix deadline Nov 17, 2023)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022PHP FastCGI Process Manager (FPM) Buffer Overflow VulnerabilityCVE-2019-11043 · Websites & servers · PHP · reported by security@php.netExploitedRansomwareHigh 8.7
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
Product
FastCGI Process Manager (FPM)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install PHP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 25, 2022PHP-CGI Query String Parameter VulnerabilityCVE-2012-1823 · Websites & servers · PHP · reported by cret@cert.orgExploitedCritical 9.8
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
Product
PHP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install PHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog eindbazen.net h20000.www2.hp.com
Mar 25, 2022phpMyAdmin Remote Code Execution VulnerabilityCVE-2009-1151 · Websites & servers · phpMyAdmin · reported by MITREExploitedCritical 9.8
Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.
Product
phpMyAdmin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install phpMyAdmin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog labs.neohapsis.com lists.opensuse.org
Feb 15, 2022PHPUnit Command Injection VulnerabilityCVE-2017-9841 · Websites & servers · PHPUnit · reported by MITREExploitedCritical 9.8
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Product
PHPUnit
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install PHPUnit’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog web.archive.org securityfocus.com
Nov 3, 2021ThinkPHP "noneCms" Remote Code Execution VulnerabilityCVE-2018-20062 · Other software · ThinkPHP · reported by MITREExploitedCritical 9.8
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
Product
noneCms
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install ThinkPHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Nov 3, 2021ThinkPHP Remote Code Execution VulnerabilityCVE-2019-9082 · Other software · ThinkPHP · reported by MITREExploitedHigh 8.8
ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Product
ThinkPHP
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install ThinkPHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Nov 3, 2021vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2019-16759 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Product
vBulletin
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2020-17496 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
Product
vBulletin
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.exploitee.rs cwe.mitre.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.