Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,120 results · page 1 of 223
Sep 16, 2026Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopbackCVE-2026-92813 · Other software · metabase · reported by VulnCheckMedium 6.9
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
- Product
- Metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protectionsCVE-2026-73058 · Other software · stoatchat · reported by VulnCheckMedium 6.9
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.
- Product
- stoatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 4, 2026Linux Kernel Unspecified VulnerabilityCVE-2026-53362 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67ExploitedHigh 7.8
Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
- Product
- Kernel
- On CISA’s list since
- Aug 27, 2026 (federal fix deadline Aug 30, 2026)
- What to do
- Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggit.kernel.orggit.kernel.org
Jun 2, 2026SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server heCVE-2026-10629 · Other software · Verizon · reported by cret@cert.orgHigh 7.4
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.
- Product
- VoLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026TanStack Unspecified VulnerabilityCVE-2026-45321 · Other software · TanStack · reported by GitHubExploitedRansomwareCritical 9.6
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
- Product
- TanStack
- On CISA’s list since
- May 27, 2026 (federal fix deadline Jun 10, 2026)
- What to do
- Attackers are using this now. Install TanStack’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
May 1, 2026Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or other unspecified impacCVE-2026-37538 · Other software · reported by MITREHigh 7.5
Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or other unspecified impacts via crafted bus_name.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 26, 2026Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.CVE-2021-4456 · Other software · MRSAM · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.
- Product
- Net::CIDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.urth.orggithub.com
Jan 21, 2026Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24.CVE-2026-1290 · Other software · Jamf · reported by 67325c3f-c596-46c5-a235-e1a1e73abe4eMedium 5.3
Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24.
- Product
- Jamf Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impacCVE-2025-67858 · Other software · https://github.com/FoobarOy/ · reported by meissner@suse.deHigh 7
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? before 0.31.
- Product
- Foomuuri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comsecurity.opensuse.org
Dec 18, 2025An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted heaCVE-2025-65561 · Other software · Free5gc · reported by MITREHigh 7.5
An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.
- Product
- Free5gc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.CVE-2025-57210 · Other software · Fuyang Lipengjun · reported by MITREHigh 7.5
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Oct 18, 2025rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact.CVE-2025-62672 · Other software · boyns · reported by MITREMedium 5.3
rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. This occurs in memcpy in the RPLAY_DATA case in rplay_unpack in librplay/rplay.c, potentially reachable via packet data with no authentication.
- Product
- rplay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsalsa.debian.orgweb.archive.org
Oct 5, 2025Oracle E-Business Suite Unspecified VulnerabilityCVE-2025-61882 · Other software · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
- Product
- E-Business Suite
- On CISA’s list since
- Oct 6, 2025 (federal fix deadline Oct 27, 2025)
- What to do
- Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogoracle.comblogs.oracle.com
Aug 22, 2025Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perfCVE-2025-4609 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 22, 2025Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web CVE-2022-43110 · Other software · reported by MITRECritical 9.8
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote attacker can make changes to the system including: changing the web interface admin password, view/change system configuration, enumerate connected UPS devices and shut down connected UPS devices. This extends to being able to configure operating system commands that should run if the system detects a connected UPS shutting down.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govready2disclose.com
Aug 21, 2025Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.CVE-2025-55524 · Other software · Agent-zero · reported by MITREHigh 7.3
Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.
- Product
- Agent-zero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with cCVE-2023-44976 · Other software · Hangzhou Shunwang · reported by MITRELow 3.2
Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.
- Product
- Rentdrv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comunit42.paloaltonetworks.com
Jul 1, 2025Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors.CVE-2025-45083 · Other software · reported by MITREMedium 6.1
Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges.CVE-2023-50450 · Other software · Sensopart · reported by MITREHigh 8.4
An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges.
- Product
- Visor Vision Sensors Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Apple Multiple Products Unspecified VulnerabilityCVE-2025-43200 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 4.2
Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.
- Product
- Multiple Products
- On CISA’s list since
- Jun 16, 2025 (federal fix deadline Jul 7, 2025)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.apple.comsupport.apple.com
May 16, 2025A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.CVE-2025-4679 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.
- Product
- Active Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.commodzero.com
Apr 25, 2025Commvault Web Server Unspecified VulnerabilityCVE-2025-3928 · Other software · Commvault · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.7
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
- Product
- Web Server
- On CISA’s list since
- Apr 28, 2025 (federal fix deadline May 19, 2025)
- What to do
- Attackers are using this now. Install Commvault’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.commvault.comcisa.gov
Mar 31, 2025An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.CVE-2025-22937 · Other software · Adtran · reported by MITRECritical 9.8
An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
- Product
- 411 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlanrat.com
Mar 26, 2025atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by CVE-2025-31160 · Other software · atop project · reported by MITRELow 2.9
atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop.
- Product
- atop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.bismuth.shgithub.com
Mar 1, 2025list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other CVE-2025-25724 · Other software · libarchive · reported by MITREMedium 4
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
- Product
- libarchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 23, 2025ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates.CVE-2024-52331 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.7
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
- Product
- Unspecified robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddontvacuum.medontvacuum.me
Jan 23, 2025ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on.CVE-2024-52328 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 1.8
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
- Product
- Unspecified robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddontvacuum.medontvacuum.me
Jan 23, 2025ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem.CVE-2024-12079 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.
- Product
- Unspecified robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages.CVE-2024-12078 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
- Product
- Unspecified robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number.CVE-2024-11147 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7
ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.
- Product
- Unspecified robots
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuilder.dontvacuum.medontvacuum.me
Nov 24, 2024The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() meCVE-2024-53901 · Other software · Tonycoz · reported by MITREMedium 5.5
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.
- Product
- Imager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.CVE-2024-44786 · Other software · meabillis_cms · reported by MITREHigh 7.5
Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.
- Product
- meabillis_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vecCVE-2024-40407 · Other software · cybelesoft · reported by MITREHigh 7.5
A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors.
- Product
- thinfinity_workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCVE-2024-51427 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer fuCVE-2024-51426 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact.CVE-2024-51425 · Other software · ethereum · reported by MITREHigh 8.8
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwnCVE-2024-51424 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vectCVE-2024-29821 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.8
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
- Product
- DSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vectCVE-2024-29213 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.8
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.
- Product
- DSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024ScienceLogic SL1 Unspecified VulnerabilityCVE-2024-9537 · Other software · ScienceLogic · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedCritical 9.3
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.
- Product
- SL1
- On CISA’s list since
- Oct 21, 2024 (federal fix deadline Nov 11, 2024)
- What to do
- Attackers are using this now. Install ScienceLogic’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogarcticwolf.comcommunity.sciencelogic.com
Oct 1, 2024An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories.CVE-2024-44744 · Other software · malwarebytes · reported by MITREMedium 5.7
An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE: Malwarebytes argues that this issue requires admin privileges and that the contents cannot be altered by non-admin users.
- Product
- premium_security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgoogleprojectzero.blogspot.commedium.com
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34785 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34783 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34779 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32848 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32846 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32845 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32843 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32842 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32840 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.