Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
Added Jan 28, 2022 · US agencies must patch by Jul 28, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
Added Jan 28, 2022 · US agencies must patch by Jul 28, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
Added Jan 28, 2022 · US agencies must patch by Jul 28, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
Added Jan 21, 2022 · US agencies must patch by Feb 4, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.
Added Jan 21, 2022 · US agencies must patch by Jul 21, 2022 · CWE-404
Fix: Apply updates per vendor instructions.
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Added Jan 21, 2022 · US agencies must patch by Jul 21, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Added Jan 21, 2022 · US agencies must patch by Jul 21, 2022
Fix: Apply updates per vendor instructions.
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-25, CWE-96
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-287
Fix: Apply updates per vendor instructions.
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-287
Fix: Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-78, CWE-138
Fix: Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-78, CWE-138
Fix: Apply updates per vendor instructions.
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-78, CWE-138
Fix: Apply updates per vendor instructions.
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-119
Fix: Apply updates per vendor instructions.
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-918
Fix: Apply updates per vendor instructions.
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
Added Jan 18, 2022 · US agencies must patch by Feb 1, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Added Jan 18, 2022 · US agencies must patch by Jul 18, 2022 · CWE-22
Fix: Apply updates per vendor instructions.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Added Jan 18, 2022 · US agencies must patch by Jul 18, 2022 · CWE-1188, CWE-306
Fix: Apply updates per vendor instructions.
Improper sanitization in the extension file names is present in Drupal core.
Added Jan 18, 2022 · US agencies must patch by Jul 18, 2022 · CWE-434
Fix: Apply updates per vendor instructions.
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Added Jan 18, 2022 · US agencies must patch by Jul 18, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Added Jan 10, 2022 · US agencies must patch by Jan 24, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
Added Jan 10, 2022 · US agencies must patch by Jan 24, 2022 · CWE-434
Fix: Apply updates per vendor instructions.
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Added Jan 10, 2022 · US agencies must patch by Jan 24, 2022 · CWE-23
Fix: Apply updates per vendor instructions.
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-611
Fix: Apply updates per vendor instructions.
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-74
Fix: Apply updates per vendor instructions.
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-134
Fix: Apply updates per vendor instructions.
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022
Fix: Apply updates per vendor instructions.
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-78
Fix: Apply updates per vendor instructions.