Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-415
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022
Fix: Apply updates per vendor instructions.
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-843
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-125
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-125, CWE-787
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-189
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022
Fix: Apply updates per vendor instructions.
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-79
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-787
Fix: The impacted product is end-of-life and should be disconnected if still in use.
The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-787
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-399
Fix: Apply updates per vendor instructions.
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS).
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-94
Fix: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022
Fix: Apply updates per vendor instructions.
Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.
Added Jun 8, 2022 · US agencies must patch by Jun 22, 2022 · CWE-120
Fix: Apply updates per vendor instructions.
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.
Added Jun 2, 2022 · US agencies must patch by Jun 6, 2022 · CWE-917
Fix: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.
Added May 25, 2022 · US agencies must patch by Jun 15, 2022
Fix: Apply updates per vendor instructions.