Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Security flaws that attackers are actively using right now, from the US cybersecurity agency's (CISA) Known Exploited Vulnerabilities catalog. If you run anything on this list, patch it first.
1756 results.
Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-22
Fix: Apply updates per vendor instructions.
SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-22
Fix: Apply updates per vendor instructions.
SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-434
Fix: Apply updates per vendor instructions.
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-306
Fix: Apply updates per vendor instructions.
SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-89
Fix: Apply updates per vendor instructions.
Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-390
Fix: Apply updates per vendor instructions.
Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-416
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-79
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-1173
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-1173
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-362, CWE-667
Fix: Apply updates per vendor instructions.
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-787
Fix: Apply updates per vendor instructions.
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-285
Fix: Apply updates per vendor instructions.
Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-122, CWE-1285
Fix: Apply updates per vendor instructions.
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-78
Fix: Apply updates per vendor instructions.
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.
Added Nov 3, 2021 · US agencies must patch by Nov 17, 2021 · CWE-78
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-415
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-787
Fix: Apply updates per vendor instructions.
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-798
Fix: Apply updates per vendor instructions.
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-269
Fix: Apply updates per vendor instructions.
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022
Fix: Apply updates per vendor instructions.
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-78
Fix: Apply updates per vendor instructions.
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-74
Fix: Apply updates per vendor instructions.
Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022
Fix: Apply updates per vendor instructions.
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-434
Fix: Apply updates per vendor instructions.
Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-94
Fix: Apply updates per vendor instructions.
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-284
Fix: Apply updates per vendor instructions.
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Added Nov 3, 2021 · US agencies must patch by May 3, 2022 · CWE-20
Fix: Apply updates per vendor instructions.