Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-285
Fix: Apply updates per vendor instructions.
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-326
Fix: Apply updates per vendor instructions.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
Added Jan 10, 2022 · US agencies must patch by Jul 10, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Added Dec 15, 2021 · US agencies must patch by Dec 29, 2021
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Dec 15, 2021 · US agencies must patch by Dec 29, 2021 · CWE-416
Fix: Apply updates per vendor instructions.
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Added Dec 10, 2021 · US agencies must patch by Dec 24, 2021
Fix: Apply updates per vendor instructions.
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
Added Dec 10, 2021 · US agencies must patch by Dec 24, 2021 · CWE-20, CWE-400, CWE-502
Fix: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Added Dec 10, 2021 · US agencies must patch by Dec 24, 2021 · CWE-494
Fix: Apply updates per vendor instructions.
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Added Dec 10, 2021 · US agencies must patch by Dec 24, 2021 · CWE-78, CWE-138
Fix: Apply updates per vendor instructions.
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-89
Fix: Apply updates per vendor instructions.
Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022
Fix: Apply updates per vendor instructions.
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-269
Fix: Apply updates per vendor instructions.
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022
Fix: Apply updates per vendor instructions.
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-502
Fix: Apply updates per vendor instructions.
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
Added Dec 10, 2021 · US agencies must patch by Jun 10, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Added Dec 1, 2021 · US agencies must patch by Dec 15, 2021 · CWE-306
Fix: Apply updates per vendor instructions.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Added Dec 1, 2021 · US agencies must patch by Dec 15, 2021 · CWE-918
Fix: Apply updates per vendor instructions.
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
Added Dec 1, 2021 · US agencies must patch by Dec 15, 2021 · CWE-306
Fix: Apply updates per vendor instructions.
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Added Dec 1, 2021 · US agencies must patch by Jun 1, 2022 · CWE-20
Fix: Apply updates per vendor instructions.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
Added Dec 1, 2021 · US agencies must patch by Jun 1, 2022 · CWE-22
Fix: Apply updates per vendor instructions.
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
Added Nov 17, 2021 · US agencies must patch by Dec 1, 2021 · CWE-184, CWE-502
Fix: Apply updates per vendor instructions.
A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.
Added Nov 17, 2021 · US agencies must patch by Dec 1, 2021 · CWE-357
Fix: Apply updates per vendor instructions.
Unspecified vulnerability allows for an authenticated user to escalate privileges.
Added Nov 17, 2021 · US agencies must patch by Dec 1, 2021 · CWE-416
Fix: Apply updates per vendor instructions.
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Added Nov 17, 2021 · US agencies must patch by Dec 1, 2021 · CWE-95
Fix: Apply updates per vendor instructions.
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-89
Fix: Apply updates per vendor instructions.