Updated 13 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

58 results · page 1 of 2

Jul 10, 2026Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-56291 · Other software · Balbooa · reported by security@joomla.orgExploitedCritical 10
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
Product
Forms
On CISA’s list since
Jul 10, 2026 (federal fix deadline Jul 13, 2026)
What to do
Attackers are using this now. Install Balbooa’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mysites.guru balbooa.com
Jul 7, 2026JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2026-48908 · Other software · JoomShaper · reported by security@joomla.orgExploitedCritical 10
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Product
SP Page Builder
On CISA’s list since
Jul 7, 2026 (federal fix deadline Jul 10, 2026)
What to do
Attackers are using this now. Install JoomShaper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog joomshaper.com extensions.joomla.org
Apr 24, 2026Samsung MagicINFO 9 Server Path Traversal VulnerabilityCVE-2024-7399 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comExploitedHigh 8.8
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
Product
MagicINFO 9 Server
On CISA’s list since
Apr 24, 2026 (federal fix deadline May 8, 2026)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungtv.com arcticwolf.com
Apr 20, 2026Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCVE-2025-32975 · Other software · Quest · reported by MITREExploitedCritical 10
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
Product
KACE Systems Management Appliance (SMA)
On CISA’s list since
Apr 20, 2026 (federal fix deadline May 4, 2026)
What to do
Attackers are using this now. Install Quest’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org seralys.com
Apr 13, 2026Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2026-21643 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Product
FortiClient EMS
On CISA’s list since
Apr 13, 2026 (federal fix deadline Apr 16, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com github.com
Apr 6, 2026Fortinet FortiClient EMS Improper Access Control VulnerabilityCVE-2026-35616 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
Product
FortiClient EMS
On CISA’s list since
Apr 6, 2026 (federal fix deadline Apr 9, 2026)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com cisa.gov
Mar 20, 2026Craft CMS Code Injection VulnerabilityCVE-2025-32432 · Other software · Craft CMS · reported by GitHubExploitedCritical 10
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
Product
Craft CMS
On CISA’s list since
Mar 20, 2026 (federal fix deadline Apr 3, 2026)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 24, 2026Soliton Systems K.K FileZen OS Command Injection VulnerabilityCVE-2026-25108 · Other software · Soliton Systems K.K · reported by vultures@jpcert.or.jpExploitedHigh 8.7
Soliton Systems K.K FileZen contains an OS command injection vulnerability when an user logs-in to the affected product and sends a specially crafted HTTP request.
Product
FileZen
On CISA’s list since
Feb 24, 2026 (federal fix deadline Mar 17, 2026)
What to do
Attackers are using this now. Install Soliton Systems K.K’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp soliton.co.jp
Feb 18, 2026Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCVE-2026-22769 · Other software · Dell · reported by security_alert@emc.comExploitedCritical 10
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
Product
RecoverPoint for Virtual Machines (RP4VMs)
On CISA’s list since
Feb 18, 2026 (federal fix deadline Feb 21, 2026)
What to do
Attackers are using this now. Install Dell’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dell.com cloud.google.com
Feb 10, 2026Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVE-2026-21513 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
Product
Windows
On CISA’s list since
Feb 10, 2026 (federal fix deadline Mar 3, 2026)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com vicarius.io
Nov 10, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21042 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 8.8
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
Product
Mobile Devices
On CISA’s list since
Nov 10, 2025 (federal fix deadline Dec 1, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com unit42.paloaltonetworks.com
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2746 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 20, 2025Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2025-2747 · Other software · Kentico · reported by VulnCheckExploitedCritical 9.8
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
Product
Xperience CMS
On CISA’s list since
Oct 20, 2025 (federal fix deadline Nov 10, 2025)
What to do
Attackers are using this now. Install Kentico’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog devnet.kentico.com github.com
Oct 15, 2025Adobe Experience Manager Forms Code Execution VulnerabilityCVE-2025-54253 · Other software · Adobe · reported by AdobeExploitedCritical 10
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Product
Experience Manager (AEM) Forms
On CISA’s list since
Oct 15, 2025 (federal fix deadline Nov 5, 2025)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com slcyber.io
Oct 2, 2025Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCVE-2025-21043 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 8.8
Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so which allows remote attackers to execute arbitrary code.
Product
Mobile Devices
On CISA’s list since
Oct 2, 2025 (federal fix deadline Oct 23, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com cisa.gov
Sep 3, 2025TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityCVE-2025-9377 · Network & remote access · TP-Link · reported by f23511db-6c3e-4e32-a477-6aa17d310630ExploitedHigh 8.6
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Routers
On CISA’s list since
Sep 3, 2025 (federal fix deadline Sep 24, 2025)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tp-link.com tp-link.com
Sep 2, 2025Meta Platforms WhatsApp Incorrect Authorization VulnerabilityCVE-2025-55177 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedMedium 5.4
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
Product
WhatsApp
On CISA’s list since
Sep 2, 2025 (federal fix deadline Sep 23, 2025)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog facebook.com whatsapp.com
Jun 2, 2025Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityCVE-2025-35939 · Other software · Craft CMS · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedMedium 6.9
Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.
Product
Craft CMS
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jun 2, 2025Craft CMS Code Injection VulnerabilityCVE-2024-56145 · Other software · Craft CMS · reported by GitHubExploitedCritical 9.3
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
Product
Craft CMS
On CISA’s list since
Jun 2, 2025 (federal fix deadline Jun 23, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
May 22, 2025Samsung MagicINFO 9 Server Path Traversal VulnerabilityCVE-2025-4632 · Computers, phones & browsers · Samsung · reported by PSIRT@samsung.comExploitedCritical 9.8
Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.
Product
MagicINFO 9 Server
On CISA’s list since
May 22, 2025 (federal fix deadline Jun 12, 2025)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungtv.com cisa.gov
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Mar 26, 2025Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
Feb 20, 2025Craft CMS Code Injection VulnerabilityCVE-2025-23209 · Other software · Craft CMS · reported by GitHubExploitedHigh 8
Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.
Product
Craft CMS
On CISA’s list since
Feb 20, 2025 (federal fix deadline Mar 13, 2025)
What to do
Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog craftcms.com github.com
Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim Systems · reported by MITREExploitedHigh 8.1
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
Product
USAHERDS
On CISA’s list since
Dec 23, 2024 (federal fix deadline Jan 13, 2025)
What to do
Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com acclaimsystems.com
Oct 8, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43573 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.5
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
Product
Windows
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Sep 16, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.
Product
Windows
On CISA’s list since
Sep 16, 2024 (federal fix deadline Oct 7, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jul 9, 2024Microsoft Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-38112 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
Product
Windows
On CISA’s list since
Jul 9, 2024 (federal fix deadline Jul 30, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 14, 2024Microsoft Windows MSHTML Platform Security Feature Bypass VulnerabilityCVE-2024-30040 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.
Product
Windows
On CISA’s list since
May 14, 2024 (federal fix deadline Jun 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 25, 2024Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2023-48788 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
Product
FortiClient EMS
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Sep 18, 2023Samsung Mobile Devices Use-After-Free VulnerabilityCVE-2022-22265 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 5
Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.
Product
Mobile Devices
On CISA’s list since
Sep 18, 2023 (federal fix deadline Oct 9, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jul 11, 2023Microsoft Windows MSHTML Platform Privilege Escalation VulnerabilityCVE-2023-32046 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Jul 11, 2023 (federal fix deadline Aug 1, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Jun 29, 2023Samsung Mobile Devices Out-of-Bounds Read VulnerabilityCVE-2021-25487 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedHigh 7.3
Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Improper Input Validation VulnerabilityCVE-2021-25489 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedLow 3.3
Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Race Condition VulnerabilityCVE-2021-25394 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.4
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Race Condition VulnerabilityCVE-2021-25395 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.4
Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Unspecified VulnerabilityCVE-2021-25371 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Jun 29, 2023Samsung Mobile Devices Improper Boundary Check VulnerabilityCVE-2021-25372 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
Product
Mobile Devices
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
May 19, 2023Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilityCVE-2023-21492 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.
Product
Mobile Devices
On CISA’s list since
May 19, 2023 (federal fix deadline Jun 9, 2023)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Mar 30, 2023Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) VulnerabilityCVE-2022-39197 · Other software · Fortra · reported by MITREExploitedMedium 6.1
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Product
Cobalt Strike
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cobaltstrike.com cobaltstrike.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25337 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 4.4
Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Nov 8, 2022Samsung Mobile Devices Improper Access Control VulnerabilityCVE-2021-25369 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.2
Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Nov 8, 2022Samsung Mobile Devices Memory Corruption VulnerabilityCVE-2021-25370 · Computers, phones & browsers · Samsung · reported by mobile.security@samsung.comExploitedMedium 6.1
Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.
Product
Mobile Devices
On CISA’s list since
Nov 8, 2022 (federal fix deadline Nov 29, 2022)
What to do
Attackers are using this now. Install Samsung’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.samsungmobile.com security.samsungmobile.com
Aug 25, 2022dotCMS Unrestricted Upload of File VulnerabilityCVE-2022-26352 · Other software · dotCMS · reported by MITREExploitedRansomwareCritical 9.8
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
Product
dotCMS
On CISA’s list since
Aug 25, 2022 (federal fix deadline Sep 15, 2022)
What to do
Attackers are using this now. Install dotCMS’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com groups.google.com
Aug 9, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-34713 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
Product
Windows
On CISA’s list since
Aug 9, 2022 (federal fix deadline Aug 30, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 14, 2022Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-30190 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Product
Windows
On CISA’s list since
Jun 14, 2022 (federal fix deadline Jul 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
May 23, 2022WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Product
WhatsApp
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com facebook.com
Apr 19, 2022WhatsApp VOIP Stack Buffer Overflow VulnerabilityCVE-2019-3568 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedCritical 9.8
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Product
WhatsApp
On CISA’s list since
Apr 19, 2022 (federal fix deadline May 10, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com facebook.com
Mar 25, 2022QNAP Helpdesk Improper Access Control VulnerabilityCVE-2020-2506 · Network & remote access · QNAP Systems · reported by security@qnapsecurity.com.twExploitedHigh 7.3
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
Product
Helpdesk
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install QNAP Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Mar 3, 2022Microsoft Office MSCOMCTL.OCX Remote Code Execution VulnerabilityCVE-2012-1856 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com us-cert.gov
Jan 18, 2022October CMS Improper AuthenticationCVE-2021-32648 · Other software · October CMS · reported by GitHubExploitedHigh 8.2
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Product
October CMS
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install October CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.