Updated 11 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

210 results · page 1 of 5

Oct 16, 2026BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCVE-2026-102764 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.3
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Product
Remote Support
On CISA’s list since
Oct 16, 2026 (federal fix deadline Oct 19, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com nvd.nist.gov
Sep 25, 2026WordPress Core Remote File Inclusion VulnerabilityCVE-2026-87902 · WordPress plugins & themes · reported by support@hackerone.comExploitedHigh 8.1
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Product
Core
On CISA’s list since
Sep 25, 2026 (federal fix deadline Sep 28, 2026)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com patchstack.com
Aug 26, 2026Microsoft SQL Server Remote Code Execution VulnerabilityCVE-2019-1068 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
Product
SQL Server
On CISA’s list since
Aug 26, 2026 (federal fix deadline Aug 29, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 23, 2026Marimo Remote Code Execution VulnerabilityCVE-2026-39987 · Other software · Marimo · reported by GitHubExploitedCritical 9.3
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Product
Marimo
On CISA’s list since
Apr 23, 2026 (federal fix deadline May 7, 2026)
What to do
Attackers are using this now. Install Marimo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Apr 14, 2026Microsoft Office Remote Code ExecutionCVE-2009-0238 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
Product
Office
On CISA’s list since
Apr 14, 2026 (federal fix deadline Apr 28, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.zdnet.com isc.sans.org
Feb 17, 2026 Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVE-2008-0015 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 8.8
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Product
Windows
On CISA’s list since
Feb 17, 2026 (federal fix deadline Mar 10, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com isc.sans.org
Feb 13, 2026BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCVE-2026-1731 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedRansomwareCritical 9.9
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Product
Remote Support (RS) and Privileged Remote Access (PRA)
On CISA’s list since
Feb 13, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install BeyondTrust’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog beyondtrustcorp.service-now.com beyondtrust.com
Jan 22, 2026Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion VulnerabilityCVE-2025-68645 · Email & office · Synacor · reported by MITREExploitedHigh 8.8
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 22, 2026 (federal fix deadline Feb 12, 2026)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
Dec 5, 2025Meta React Server Components Remote Code Execution VulnerabilityCVE-2025-55182 · Other software · Meta · reported by cve-assign@fb.comExploitedRansomwareCritical 10
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Product
React Server Components
On CISA’s list since
Dec 5, 2025 (federal fix deadline Dec 12, 2025)
What to do
Attackers are using this now. Install Meta’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog react.dev facebook.com
Oct 6, 2025Microsoft Windows Remote Code Execution VulnerabilityCVE-2011-3402 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.
Product
Windows
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.mcafee.com blogs.technet.com
Oct 6, 2025Mozilla Multiple Products Remote Code Execution VulnerabilityCVE-2010-3765 · Computers, phones & browsers · Mozilla · reported by MITREExploitedCritical 9.8
Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
Product
Multiple Products
On CISA’s list since
Oct 6, 2025 (federal fix deadline Oct 27, 2025)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.mozilla.com blogs.sun.com
Oct 2, 2025Jenkins Remote Code Execution VulnerabilityCVE-2017-1000353 · Websites & servers · Jenkins · reported by MITREExploitedCritical 9.8
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
Product
Jenkins
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Sep 29, 2025Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution VulnerabilityCVE-2025-20352 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.7
Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
Product
IOS and IOS XE
On CISA’s list since
Sep 29, 2025 (federal fix deadline Oct 20, 2025)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Aug 12, 2025Microsoft Office Excel Remote Code Execution VulnerabilityCVE-2007-0671 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.
Product
Office
On CISA’s list since
Aug 12, 2025 (federal fix deadline Sep 2, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedMedium 6.6
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Jan 13, 2025 (federal fix deadline Feb 3, 2025)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Product
Privileged Remote Access (PRA) and Remote Support (RS)
On CISA’s list since
Dec 19, 2024 (federal fix deadline Dec 27, 2024)
What to do
Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog nvd.nist.gov beyondtrust.com
Oct 8, 2024Microsoft Windows Management Console Remote Code Execution VulnerabilityCVE-2024-43572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 18, 2024Oracle WebLogic Server Remote Code Execution VulnerabilityCVE-2020-14644 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Product
WebLogic Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Sep 18, 2024Microsoft SQL Server Reporting Services Remote Code Execution VulnerabilityCVE-2020-0618 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
Product
SQL Server
On CISA’s list since
Sep 18, 2024 (federal fix deadline Oct 9, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 13, 2024Microsoft Project Remote Code Execution Vulnerability CVE-2024-38189 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.
Product
Project
On CISA’s list since
Aug 13, 2024 (federal fix deadline Sep 3, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Aug 7, 2024Android Kernel Remote Code Execution VulnerabilityCVE-2024-36971 · Computers, phones & browsers · Android · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
Product
Kernel
On CISA’s list since
Aug 7, 2024 (federal fix deadline Aug 28, 2024)
What to do
Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.kernel.org git.kernel.org
Jan 2, 2024Spreadsheet::ParseExcel Remote Code Execution VulnerabilityCVE-2023-7101 · Other software · Spreadsheet::ParseExcel · reported by mandiant-cve@google.comExploitedHigh 7.8
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
Product
Spreadsheet::ParseExcel
On CISA’s list since
Jan 2, 2024 (federal fix deadline Jan 23, 2024)
What to do
Attackers are using this now. Install Spreadsheet::ParseExcel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com github.com
Sep 21, 2023Trend Micro Apex One and Worry-Free Business Security Remote Code Execution VulnerabilityCVE-2023-41179 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.2
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Product
Apex One and Worry-Free Business Security
On CISA’s list since
Sep 21, 2023 (federal fix deadline Oct 12, 2023)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp success.trendmicro.com
Jul 17, 2023Microsoft Windows Search Remote Code Execution VulnerabilityCVE-2023-36884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.5
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.
Product
Windows
On CISA’s list since
Jul 17, 2023 (federal fix deadline Aug 29, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Jun 22, 2023Roundcube Webmail Remote Code Execution VulnerabilityCVE-2020-12641 · Websites & servers · Roundcube · reported by MITREExploitedCritical 9.8
Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Product
Roundcube Webmail
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org github.com
May 12, 2023Apache Tomcat Remote Code Execution VulnerabilityCVE-2016-8735 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Product
Tomcat
On CISA’s list since
May 12, 2023 (federal fix deadline Jun 2, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com seclists.org
Apr 19, 2023Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6742 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
Product
IOS and IOS XE Software
On CISA’s list since
Apr 19, 2023 (federal fix deadline May 10, 2023)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 30, 2023Samba Remote Code Execution VulnerabilityCVE-2017-7494 · Other software · Samba · reported by Red HatExploitedRansomwareCritical 9.8
Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
Product
Samba
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Samba’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog debian.org securityfocus.com
Mar 30, 2023Fortra Cobalt Strike User Interface Remote Code Execution VulnerabilityCVE-2022-42948 · Other software · Fortra · reported by MITREExploitedCritical 9.8
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
Product
Cobalt Strike
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog thesecmaster.com cobaltstrike.com
Mar 10, 2023XStream Remote Code Execution VulnerabilityCVE-2021-39144 · Other software · XStream · reported by GitHubExploitedHigh 8.5
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
Product
XStream
On CISA’s list since
Mar 10, 2023 (federal fix deadline Mar 31, 2023)
What to do
Attackers are using this now. Install XStream’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Mar 10, 2023Plex Media Server Remote Code Execution VulnerabilityCVE-2020-5741 · Other software · Plex · reported by vulnreport@tenable.comExploitedHigh 7.2
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Product
Media Server
On CISA’s list since
Mar 10, 2023 (federal fix deadline Mar 31, 2023)
What to do
Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
Mar 7, 2023Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityCVE-2022-28810 · Email & office · Zoho · reported by MITREExploitedMedium 6.8
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Product
ManageEngine
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Mar 7, 2023Teclib GLPI Remote Code Execution VulnerabilityCVE-2022-35914 · Other software · Teclib · reported by MITREExploitedCritical 9.8
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
Product
GLPI
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Teclib’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com bioinformatics.org
Feb 10, 2023TerraMaster OS Remote Command Execution VulnerabilityCVE-2022-24990 · Other software · TerraMaster · reported by MITREExploitedRansomwareHigh 7.5
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Product
TerraMaster OS
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install TerraMaster’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forum.terra-master.com
Feb 10, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · Fortra · reported by cve@rapid7.comExploitedRansomwareHigh 7.2
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Product
GoAnywhere MFT
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com attackerkb.com
Feb 2, 2023Multiple SugarCRM Products Remote Code Execution VulnerabilityCVE-2023-22952 · Other software · SugarCRM · reported by MITREExploitedHigh 8.8
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Product
Multiple Products
On CISA’s list since
Feb 2, 2023 (federal fix deadline Feb 23, 2023)
What to do
Attackers are using this now. Install SugarCRM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.sugarcrm.com
Jan 23, 2023Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-47966 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Product
ManageEngine
On CISA’s list since
Jan 23, 2023 (federal fix deadline Feb 13, 2023)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26500 · Other software · Veeam · reported by MITREExploitedRansomwareHigh 8.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Product
Backup & Replication
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com veeam.com
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26501 · Other software · Veeam · reported by MITREExploitedRansomwareCritical 9.8
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Product
Backup & Replication
On CISA’s list since
Dec 13, 2022 (federal fix deadline Jan 3, 2023)
What to do
Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog veeam.com veeam.com
Nov 8, 2022Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityCVE-2022-41128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
Product
Windows
On CISA’s list since
Nov 8, 2022 (federal fix deadline Dec 9, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Sep 30, 2022Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2022-41082 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Product
Exchange Server
On CISA’s list since
Sep 30, 2022 (federal fix deadline Oct 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Sep 22, 2022Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-35405 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Product
ManageEngine
On CISA’s list since
Sep 22, 2022 (federal fix deadline Oct 13, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com manageengine.com
Sep 15, 2022Microsoft Windows Remote Code Execution VulnerabilityCVE-2010-2568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.
Product
Windows
On CISA’s list since
Sep 15, 2022 (federal fix deadline Oct 6, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog isc.sans.edu isc.sans.edu
Sep 14, 2022Apple iOS, iPadOS, and macOS Remote Code Execution VulnerabilityCVE-2022-32917 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 7.8
Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 14, 2022 (federal fix deadline Oct 5, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seclists.org
Sep 8, 2022D-Link DIR-820L Remote Code Execution VulnerabilityCVE-2022-26258 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.
Product
DIR-820L
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Aug 25, 2022VMware Tanzu Spring Cloud Function Remote Code Execution VulnerabilityCVE-2022-22963 · Other software · VMware Tanzu · reported by security@vmware.comExploitedCritical 9.8
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Product
Spring Cloud
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install VMware Tanzu’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com psirt.global.sonicwall.com
Aug 18, 2022Microsoft Windows Runtime Remote Code Execution VulnerabilityCVE-2022-21971 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Aug 18, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2017-15944 · Network & remote access · Palo Alto Networks · reported by MITREExploitedCritical 9.8
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Product
PAN-OS
On CISA’s list since
Aug 18, 2022 (federal fix deadline Sep 8, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Aug 9, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-34713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
Product
Windows
On CISA’s list since
Aug 9, 2022 (federal fix deadline Aug 30, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 14, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-30190 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Product
Windows
On CISA’s list since
Jun 14, 2022 (federal fix deadline Jul 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.