Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Added Mar 7, 2023 · US agencies must patch by Mar 28, 2023 · CWE-78, CWE-259
Fix: Apply updates per vendor instructions.
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
Added Feb 27, 2023 · US agencies must patch by Mar 20, 2023 · CWE-441
Fix: Apply updates per vendor instructions.
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Added Feb 21, 2023 · US agencies must patch by Mar 14, 2023 · CWE-502
Fix: Apply updates per vendor instructions.
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
Added Feb 21, 2023 · US agencies must patch by Mar 14, 2023 · CWE-94
Fix: Apply updates per vendor instructions.
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Added Feb 21, 2023 · US agencies must patch by Mar 14, 2023 · CWE-77
Fix: Apply updates per vendor instructions.
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
Added Feb 16, 2023 · US agencies must patch by Mar 9, 2023 · CWE-74
Fix: Apply updates per vendor instructions.
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Added Feb 14, 2023 · US agencies must patch by Mar 7, 2023 · CWE-843
Fix: Apply updates per vendor instructions.
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Added Feb 14, 2023 · US agencies must patch by Mar 7, 2023 · CWE-122
Fix: Apply updates per vendor instructions.
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Added Feb 14, 2023 · US agencies must patch by Mar 7, 2023 · CWE-190
Fix: Apply updates per vendor instructions.
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Added Feb 14, 2023 · US agencies must patch by Mar 7, 2023 · CWE-863
Fix: Apply updates per vendor instructions.
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Added Feb 10, 2023 · US agencies must patch by Mar 3, 2023 · CWE-502
Fix: Apply updates per vendor instructions.
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Added Feb 10, 2023 · US agencies must patch by Mar 3, 2023 · CWE-306
Fix: Apply updates per vendor instructions.
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Added Feb 10, 2023 · US agencies must patch by Mar 3, 2023 · CWE-20
Fix: Apply updates per vendor instructions.
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Added Feb 2, 2023 · US agencies must patch by Feb 23, 2023 · CWE-20
Fix: Apply updates per vendor instructions.
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Added Feb 2, 2023 · US agencies must patch by Feb 23, 2023 · CWE-306
Fix: Apply updates per vendor instructions.
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Added Jan 26, 2023 · US agencies must patch by Feb 16, 2023 · CWE-20
Fix: Apply updates per vendor instructions.
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Added Jan 23, 2023 · US agencies must patch by Feb 13, 2023
Fix: Apply updates per vendor instructions.
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Added Jan 17, 2023 · US agencies must patch by Feb 7, 2023 · CWE-78
Fix: Apply updates per vendor instructions.
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Added Jan 10, 2023 · US agencies must patch by Jan 31, 2023 · CWE-416
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Added Jan 10, 2023 · US agencies must patch by Jan 31, 2023
Fix: Apply updates per vendor instructions.
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Added Dec 29, 2022 · US agencies must patch by Jan 19, 2023 · CWE-22
Fix: Apply updates per vendor instructions.
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Added Dec 29, 2022 · US agencies must patch by Jan 19, 2023 · CWE-22
Fix: Apply updates per vendor instructions.
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Added Dec 14, 2022 · US agencies must patch by Jan 4, 2023 · CWE-843
Fix: Apply updates per vendor instructions.
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Added Dec 13, 2022 · US agencies must patch by Jan 3, 2023 · CWE-755
Fix: Apply updates per vendor instructions.
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Added Dec 13, 2022 · US agencies must patch by Jan 3, 2023 · CWE-197
Fix: Apply updates per vendor instructions.
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Added Dec 13, 2022 · US agencies must patch by Jan 3, 2023 · CWE-664
Fix: Apply updates per vendor instructions.
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Added Dec 13, 2022 · US agencies must patch by Jan 3, 2023 · CWE-306
Fix: Apply updates per vendor instructions.
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Added Dec 13, 2022 · US agencies must patch by Jan 3, 2023 · CWE-22
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Dec 5, 2022 · US agencies must patch by Dec 26, 2022 · CWE-122, CWE-843
Fix: Apply updates per vendor instructions.
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 28, 2022 · US agencies must patch by Dec 19, 2022 · CWE-787
Fix: Apply updates per vendor instructions.