Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-918
Fix: Apply updates per vendor instructions.
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-20, CWE-78
Fix: Apply updates per vendor instructions.
Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-89, CWE-138
Fix: Apply updates per vendor instructions.
Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-39
Fix: Apply updates per vendor instructions.
Microsoft Office contains an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-502
Fix: Apply updates per vendor instructions.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-918
Fix: Apply updates per vendor instructions.
Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-416
Fix: Apply updates per vendor instructions.
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-917
Fix: Apply updates per vendor instructions.
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-284
Fix: Apply updates per vendor instructions.
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-863
Fix: Apply updates per vendor instructions.
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-77
Fix: Apply updates per vendor instructions.
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-287
Fix: Apply updates per vendor instructions.
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021
Fix: Apply updates per vendor instructions.
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-20, CWE-78
Fix: Apply updates per vendor instructions.
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-20, CWE-95
Fix: Apply updates per vendor instructions.
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-23
Fix: Apply updates per vendor instructions.
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-20, CWE-470, CWE-918
Fix: Apply updates per vendor instructions.
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-23
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-843
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-20, CWE-122
Fix: Apply updates per vendor instructions.
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-416
Fix: Apply updates per vendor instructions.
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-416
Fix: Apply updates per vendor instructions.
Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-122, CWE-362
Fix: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-122
Fix: Apply updates per vendor instructions.
Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-122
Fix: Apply updates per vendor instructions.