Known exploited vulnerabilities
Under attack, per CISA.
- exim, canonical ubuntu linux, debian linux +1 more +3 more A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient... 9.0 Critical
- synacor zimbra collaboration suite, zimbra collaboration suite (zcs) +1 more mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML... 9.8 Critical
- fortinet fortios, fortiproxy, fortios and fortiproxy +2 more A heap buffer overflow in Fortinet FortiOS all versions below 6.0.5 in the SSL VPN web portal may... 4.3 Medium
- oracle weblogic server, agile product lifecycle management, communications converged application server +5 more +7 more Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:... 7.5 High
- elastic kibana, redhat openshift container platform +1 more Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion... 10.0 Critical
- primetek primefaces, primefaces application +1 more Inadequate Encryption Strength 9.8 Critical
- ibm sterling b2b integrator, sterling integrator, tivoli common reporting +5 more +7 more Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT... 9.8 Critical
- microsoft winverifytrust function, windows 10 version 1507, windows 10 version 1607 +42 more +44 more WinVerifyTrust Signature Validation Vulnerability 5.5 Medium
- google chrome, chromium v8 +1 more Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to... 8.8 High
- microsoft app installer, windows +1 more Windows AppX Installer Spoofing Vulnerability 7.1 High
- fortinet fortios A download of code without integrity check vulnerability in the "execute restore src-vis" command... 3.3 Low
- zoho desktop central, zohocorp manageengine desktop central +1 more Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code... 9.8 Critical
- apache log4j, log4j2, apple xcode +141 more +143 more Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints 10.0 Critical
- realtek jungle software development kit (sdk), rtl819x jungle software development kit +1 more Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that... 9.8 Critical
- fuel cms cms, thedaylightstudio fuel cms +1 more FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or... 9.8 Critical
- pi-hole adminlte, pi-hole +1 more Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via... 9.1 Critical
- mongo-express project mongo-express Remote Code Execution Vulnerability in NPM mongo-express 9.9 Critical
- apache solr, debian linux +1 more XML External Entity (XXE) Injection in Apache Solr 7.2 High
- debian linux, linux kernel, canonical ubuntu linux +19 more +21 more In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the... 7.8 High
- sonatype nexus repository manager Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. 9.8 Critical
- embedthis goahead, oracle integrated lights out manager +1 more Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program... 8.1 High
- red hat jboss application server, red hat, inc. jbossas, redhat jboss enterprise application platform +2 more In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was... 9.8 Critical
- red hat jboss seam 2, redhat jboss enterprise application platform, netapp oncommand balance +2 more +4 more JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat... 8.8 High
- zohocorp manageengine servicedesk plus, zoho manageengine servicedesk plus (sdp) / supportcenter plus, zohocorp manageengine servicedesk plus msp +1 more +3 more Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and... 9.8 Critical
- apache, apache http server, broadcom brocade fabric operating system firmware +36 more +38 more mod_proxy SSRF 9.0 Critical
- zohocorp manageengine servicedesk plus, zoho manageengine servicedesk plus (sdp) +1 more Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that... 9.8 Critical
- qualcomm snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, apq8009 firmware, apq8009w firmware +397 more +399 more Memory corruption due to improper check to return error when user application requests memory... 7.8 High
- mikrotik routeros MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files... 9.1 Critical
- microsoft exchange, exchange server, exchange server 2016 cumulative update 21 +3 more +5 more Microsoft Exchange Server Remote Code Execution Vulnerability 8.8 High
- microsoft excel, 365 apps, 365 apps for enterprise +10 more +12 more Microsoft Excel Security Feature Bypass Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +38 more +40 more Win32k Elevation of Privilege Vulnerability 7.8 High
- exiftool, debian linux, fedoraproject fedora +2 more Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up... 6.8 Medium
- google chrome, debian linux, fedoraproject fedora +1 more +3 more Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote... 8.8 High
- google android, chrome, debian linux +2 more +4 more Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0... 6.1 Medium
- bqe billquick web suite BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for... 9.8 Critical
- apple ipados, macos, watchos +2 more +4 more A memory corruption issue was addressed with improved memory handling. This issue is fixed in... 7.8 High
- yealink device management Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1... 9.8 Critical
- google chrome, debian linux, fedoraproject fedora +1 more +3 more Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote... 6.5 Medium
- google chrome, debian linux, fedoraproject fedora +1 more +3 more Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who... 9.6 Critical
- google chrome, debian linux, fedoraproject fedora +1 more +3 more Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to... 8.8 High
- apache http server, fedoraproject fedora, netapp cloud backup +3 more +5 more Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) 9.8 Critical
- apache http server, fedoraproject fedora, netapp cloud backup +1 more +3 more Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 9.8 Critical
- vmware vcenter server, cloud foundation +1 more The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A... 9.8 Critical
- google chrome, fedoraproject fedora, google chromium indexed db api +2 more Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker... 9.6 Critical
- google chrome, fedoraproject fedora, google chromium v8 +2 more Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to... 8.8 High
- microsoft mshtml, windows 10 version 1507, windows 10 version 1607 +34 more +36 more Microsoft MSHTML Remote Code Execution Vulnerability 8.8 High
- microsoft open management infrastructure, azure automation state configuration, dsc extension, azure automation update management +12 more +14 more Open Management Infrastructure Elevation of Privilege Vulnerability 7.0 High
- microsoft open management infrastructure, azure automation state configuration, dsc extension, azure automation update management +12 more +14 more Open Management Infrastructure Elevation of Privilege Vulnerability 7.8 High
- microsoft open management infrastructure, open management infrastructure (omi), azure automation state configuration, dsc extension +11 more +13 more Open Management Infrastructure (OMI) Remote Code Execution Vulnerability 9.8 Critical
- microsoft open management infrastructure, azure automation state configuration, dsc extension, azure automation update management +11 more +13 more Open Management Infrastructure Elevation of Privilege Vulnerability 7.8 High
- Show olderLoading…