Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
Added Apr 6, 2022 · US agencies must patch by Apr 27, 2022 · CWE-122, CWE-193
Fix: Apply updates per vendor instructions.
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
Added Apr 6, 2022 · US agencies must patch by Apr 27, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
Added Apr 6, 2022 · US agencies must patch by Apr 27, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Added Apr 4, 2022 · US agencies must patch by Apr 25, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
Added Apr 4, 2022 · US agencies must patch by Apr 25, 2022 · CWE-20, CWE-125
Fix: Apply updates per vendor instructions.
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
Added Apr 4, 2022 · US agencies must patch by Apr 25, 2022 · CWE-20, CWE-125
Fix: Apply updates per vendor instructions.
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
Added Apr 4, 2022 · US agencies must patch by Apr 25, 2022 · CWE-78
Fix: The impacted product is end-of-life and should be disconnected if still in use.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-184
Fix: Apply updates per vendor instructions.
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-158
Fix: Apply updates per vendor instructions.
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-269
Fix: Apply updates per vendor instructions.
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-285
Fix: Apply updates per vendor instructions.
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-782
Fix: Apply updates per vendor instructions.
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-78
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
Added Mar 31, 2022 · US agencies must patch by Apr 21, 2022 · CWE-287
Fix: The impacted product is end-of-life and should be disconnected if still in use.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-843
Fix: Apply updates per vendor instructions.
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-862
Fix: Apply updates per vendor instructions.
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022
Fix: Apply updates per vendor instructions.
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-425
Fix: Apply updates per vendor instructions.
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-89
Fix: The impacted product is end-of-life and should be disconnected if still in use.
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-22
Fix: Apply updates per vendor instructions.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022
Fix: Apply updates per vendor instructions.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-404
Fix: Apply updates per vendor instructions.
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-404
Fix: Apply updates per vendor instructions.
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022
Fix: Apply updates per vendor instructions.
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-200
Fix: Apply updates per vendor instructions.
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-704
Fix: Apply updates per vendor instructions.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Added Mar 28, 2022 · US agencies must patch by Apr 18, 2022 · CWE-119
Fix: Apply updates per vendor instructions.