Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

16 results

Dec 3, 2025OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2021-26828 · Other software · OpenPLC · reported by MITREExploitedHigh 8.8
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Product
ScadaBR
On CISA’s list since
Dec 3, 2025 (federal fix deadline Dec 24, 2025)
What to do
Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.scadabr.com.br packetstormsecurity.com
Nov 28, 2025OpenPLC ScadaBR Cross-site Scripting VulnerabilityCVE-2021-26829 · Other software · OpenPLC · reported by MITREExploitedMedium 5.4
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
Product
ScadaBR
On CISA’s list since
Nov 28, 2025 (federal fix deadline Dec 19, 2025)
What to do
Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forum.scadabr.com.br youtu.be
Jul 17, 2024Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityCVE-2024-34102 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Jul 17, 2024 (federal fix deadline Aug 7, 2024)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com vicarius.io
Aug 24, 2023Ignite Realtime Openfire Path Traversal VulnerabilityCVE-2023-32315 · Other software · Ignite Realtime · reported by GitHubExploitedHigh 8.6
Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.
Product
Openfire
On CISA’s list since
Aug 24, 2023 (federal fix deadline Sep 14, 2023)
What to do
Attackers are using this now. Install Ignite Realtime’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
May 25, 2022Microsoft Windows Open Type Font Remote Code Execution VulnerabilityCVE-2016-7256 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 23, 2022Cisco IOS XR Open Port VulnerabilityCVE-2022-20821 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Product
IOS XR
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
May 4, 2022OpenSSL Information Disclosure VulnerabilityCVE-2014-0160 · Websites & servers · OpenSSL · reported by Red HatExploitedHigh 7.5
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Product
OpenSSL
On CISA’s list since
May 4, 2022 (federal fix deadline May 25, 2022)
What to do
Attackers are using this now. Install OpenSSL’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog advisories.mageia.org blog.fox-it.com
Mar 25, 2022OpenSMTPD Remote Code Execution VulnerabilityCVE-2020-7247 · Other software · OpenBSD · reported by MITREExploitedCritical 9.8
smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.
Product
OpenSMTPD
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install OpenBSD’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022HP OpenView Network Node Manager Remote Code Execution VulnerabilityCVE-2005-2773 · Other software · Hewlett Packard (HP) · reported by MITREExploitedCritical 9.8
HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.
Product
OpenView Network Node Manager
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog marc.info secunia.com
Feb 15, 2022Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityCVE-2022-24086 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Feb 15, 2022 (federal fix deadline Mar 1, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityCVE-2021-38647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38649 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38648 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityCVE-2019-5544 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
Product
VMware ESXi and Horizon DaaS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Nov 3, 2021VMware ESXi OpenSLP Use-After-Free VulnerabilityCVE-2020-3992 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
Product
ESXi
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com zerodayinitiative.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.