Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jun 12, 2026Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityCVE-2026-35273 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.
- Product
- PeopleSoft Enterprise PeopleTools
- On CISA’s list since
- Jun 12, 2026 (federal fix deadline Jun 15, 2026)
- What to do
- Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogoracle.comcisa.gov
May 27, 2026Daemon Tools Lite Embedded Malicious Code VulnerabilityCVE-2026-8398 · Other software · Daemon · reported by vulnerability@kaspersky.comExploitedCritical 9.3
Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.
- Product
- Daemon Tools Lite
- On CISA’s list since
- May 27, 2026 (federal fix deadline May 30, 2026)
- What to do
- Attackers are using this now. Install Daemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.daemon-tools.ccsecurelist.com
Feb 5, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
- Product
- SmarterMail
- On CISA’s list since
- Feb 5, 2026 (federal fix deadline Feb 26, 2026)
- What to do
- Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcode-white.comsmartertools.com
Jan 26, 2026SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2025-52691 · Other software · SmarterTools · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4ExploitedRansomwareCritical 10
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- Product
- SmarterMail
- On CISA’s list since
- Jan 26, 2026 (federal fix deadline Feb 16, 2026)
- What to do
- Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcsa.gov.sggithub.com
Jan 26, 2026SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-23760 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
- Product
- SmarterMail
- On CISA’s list since
- Jan 26, 2026 (federal fix deadline Feb 16, 2026)
- What to do
- Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcode-white.comlabs.watchtowr.com
Oct 30, 2025Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCVE-2025-41244 · Other software · Broadcom · reported by security@vmware.comExploitedHigh 7.8
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- Product
- VMware Aria Operations and VMware Tools
- On CISA’s list since
- Oct 30, 2025 (federal fix deadline Nov 20, 2025)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comopenwall.com
Jul 15, 2024OSGeo GeoServer GeoTools Eval Injection VulnerabilityCVE-2024-36401 · Other software · OSGeo · reported by GitHubExploitedCritical 9.8
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
- Product
- GeoServer
- On CISA’s list since
- Jul 15, 2024 (federal fix deadline Aug 5, 2024)
- What to do
- Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jun 23, 2023VMware Tools Authentication Bypass VulnerabilityCVE-2023-20867 · Other software · VMware · reported by security@vmware.comExploitedLow 3.9
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
- Product
- Tools
- On CISA’s list since
- Jun 23, 2023 (federal fix deadline Jul 14, 2023)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.