Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-287
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-404
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-264
Fix: Apply updates per vendor instructions.
The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.
Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
Added Mar 7, 2022 · US agencies must patch by Mar 21, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
Added Mar 7, 2022 · US agencies must patch by Mar 21, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
Added Mar 7, 2022 · US agencies must patch by Mar 21, 2022 · CWE-20, CWE-918
Fix: Apply updates per vendor instructions.
A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-74
Fix: Apply updates per vendor instructions.
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-352
Fix: Apply updates per vendor instructions.
Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-200
Fix: Apply updates per vendor instructions.
Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-264
Fix: Apply updates per vendor instructions.
Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022 · CWE-255
Fix: Apply updates per vendor instructions.
Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.
Added Mar 7, 2022 · US agencies must patch by Sep 7, 2022
Fix: Apply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-121
Fix: Apply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-347
Fix: Apply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-121
Fix: Apply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-121
Fix: Apply updates per vendor instructions.
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-785
Fix: Apply updates per vendor instructions.
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-1386
Fix: Apply updates per vendor instructions.
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022
Fix: Apply updates per vendor instructions.
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-125
Fix: Apply updates per vendor instructions.
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.
Added Mar 3, 2022 · US agencies must patch by Mar 17, 2022
Fix: Apply updates per vendor instructions.