Updated 24 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

36 results

Jan 8, 2026A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installCVE-2025-69260 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jan 8, 2026A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affecteCVE-2025-69259 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability..
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jan 8, 2026A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executablCVE-2025-69258 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to informCVE-2025-30680 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.1
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically apply Trend Micro's monthly maintenance releases to the SaaS instance do not have to take any further action.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain paraCVE-2025-30679 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain paraCVE-2025-30678 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected inCVE-2025-49220 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected iCVE-2025-49219 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execuCVE-2025-47867 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affecCVE-2025-47866 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.3
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 17, 2025A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affectCVE-2025-47865 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local serCVE-2023-52331 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.1
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend MicrCVE-2023-52330 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-52329 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52326.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-52328 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52329.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-52327 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52328.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-52326 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52327.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installatiCVE-2023-52325 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations.CVE-2023-52324 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 8.8
An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interaCVE-2023-38627 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38626.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interaCVE-2023-38626 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38625.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interaCVE-2023-38625 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38624.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jan 23, 2024A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interaCVE-2023-38624 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38625 through CVE-2023-38627.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32605 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32604.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32604 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32605.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32537 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32536.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32536 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32537.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 26, 2023Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-32535 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32534.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-32534 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-32533 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-32532 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve reCVE-2023-32531 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.1
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32532 through 32535.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could CVE-2023-32530 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 8.8
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32529.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Jun 26, 2023Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could CVE-2023-32529 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 8.8
Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution. Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities. This is similar to, but not identical to CVE-2023-32530.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com zerodayinitiative.com
Mar 29, 2022Trend Micro Apex Central Arbitrary File Upload VulnerabilityCVE-2022-26871 · Other software · Trend Micro · reported by security@trendmicro.comExploitedCritical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Product
Apex Central
On CISA’s list since
Mar 31, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog appweb.trendmicro.com jvn.jp
Dec 20, 2019Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console.CVE-2019-19692 · Other software · Trend Micro · reported by security@trendmicro.comMedium 6.1
Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console. Note that the Japanese version of the product is NOT affected.
Product
Trend Micro Apex Central
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.