Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

20 results

Dec 16, 2025Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityCVE-2025-59718 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
Product
Multiple Products
On CISA’s list since
Dec 16, 2025 (federal fix deadline Dec 23, 2025)
What to do
Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.fortinet.com arcticwolf.com
Dec 15, 2025Gladinet CentreStack and Triofox Hard Coded Cryptographic VulnerabilityCVE-2025-14611 · Other software · Gladinet · reported by 5dacb0b8-2277-4717-899c-254586fe4912ExploitedHigh 7.1
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
Product
CentreStack and Triofox
On CISA’s list since
Dec 15, 2025 (federal fix deadline Jan 5, 2026)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huntress.com cisa.gov
Apr 8, 2025Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityCVE-2025-30406 · Other software · Gladinet · reported by MITREExploitedCritical 9
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Product
CentreStack
On CISA’s list since
Apr 8, 2025 (federal fix deadline Apr 29, 2025)
What to do
Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gladinetsupport.s3.us-east-1.amazonaws.com centrestack.com
Jul 7, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2021-29256 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Jul 7, 2023 (federal fix deadline Jul 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Apr 7, 2023Arm Mali GPU Kernel Driver Information Disclosure VulnerabilityCVE-2023-26083 · Computers, phones & browsers · Arm · reported by MITREExploitedLow 3.3
Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com cybersecurity-help.cz
Mar 30, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2022-38181 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com developer.arm.com
Mar 30, 2023Arm Mali GPU Kernel Driver Unspecified VulnerabilityCVE-2022-22706 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 7.8
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Mar 30, 2023 (federal fix deadline Apr 20, 2023)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Feb 14, 2023Microsoft Windows Graphic Component Privilege Escalation VulnerabilityCVE-2023-21823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Feb 14, 2023 (federal fix deadline Mar 7, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
May 25, 2022Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution VulnerabilityCVE-2016-3393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
May 24, 2022Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCVE-2017-0005 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 28, 2022Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityCVE-2018-8405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Product
DirectX Graphics Kernel (DXGKRNL)
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Microsoft GDI Remote Code Execution VulnerabilityCVE-2019-0903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.
Product
Graphics Device Interface (GDI)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 3, 2022Microsoft Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCVE-2017-0001 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges
Product
Graphics Device Interface (GDI)
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Feb 15, 2022Microsoft Graphics Component Memory Corruption VulnerabilityCVE-2013-3906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
Product
Graphics Component
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.mcafee.com blogs.technet.com
Nov 3, 2021Arm Mali Graphics Processing Unit (GPU) Unspecified VulnerabilityCVE-2021-28664 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali Graphics Processing Unit (GPU) kernel driver contains an unspecified vulnerability that may allow a non-privileged user to gain write access to read-only memory, gain root privilege, corrupt memory, and modify the memory of other processes.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Nov 3, 2021Arm Mali Graphics Processing Unit (GPU) Use-After-Free VulnerabilityCVE-2021-28663 · Computers, phones & browsers · Arm · reported by MITREExploitedHigh 8.8
Arm Mali Graphics Processing Unit (GPU) kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information.
Product
Mali Graphics Processing Unit (GPU)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog developer.arm.com developer.arm.com
Nov 3, 2021Microsoft Enhanced Cryptographic Provider Privilege Escalation VulnerabilityCVE-2021-31201 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.2
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
Product
Enhanced Cryptographic Provider
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Enhanced Cryptographic Provider Privilege Escalation VulnerabilityCVE-2021-31199 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.2
Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.
Product
Enhanced Cryptographic Provider
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness VulnerabilityCVE-2017-9248 · Other software · Progress · reported by MITREExploitedCritical 9.8
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
Product
ASP.NET AJAX and Sitefinity
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com telerik.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.