Known exploited vulnerabilities
Under attack, per CISA.
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 more Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans 8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 more Microsoft SharePoint Server Spoofing Vulnerability 6.5 Medium
- microsoft excel, excel viewer, office +2 more +4 more Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3... 9.3 High
- adobe acrobat, acrobat 2024, acrobat and reader +2 more +4 more Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) 8.6 High
- fortinet forticlientems, forticlient ems +1 more An improper neutralization of special elements used in an sql command ('sql injection')... 9.1 Critical
- microsoft windows, windows 11 version 24h2, windows 11 version 25h2 +4 more +6 more Host Process for Windows Tasks Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +32 more +34 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 23 +2 more +4 more Microsoft Exchange Server Remote Code Execution Vulnerability 8.8 High
- adobe acrobat, acrobat and reader, acrobat dc +1 more +3 more Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and... 7.8 High
- microsoft office, visual basic for applications (vba), visual basic for applications +1 more +3 more Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3,... 6.9 Medium
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated... 9.8 Critical
- fortinet forticlientems, forticlient ems +1 more A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow... 9.1 Critical
- trueconf client, trueconf +1 more TrueConf Client Update Integrity Verification Bypass 7.8 High
- google chrome, dawn +1 more Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had... 8.8 High
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more Insufficient input validation leading to memory overread 9.3 Critical
- f5 big-ip, big-ip access policy manager +1 more BigIP APM Vulnerability 9.3 Critical
- aquasec setup-trivy, trivy, aquasecurity trivy-action +3 more +5 more Trivy ecosystem supply chain briefly compromised 9.4 Critical
- langflow Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint 9.3 Critical
- apple ipados, macos, tvos +5 more +7 more A memory corruption issue was addressed with improved lock state checking. This issue is fixed in... 7.8 High
- apple ipados, macos, tvos +5 more +7 more A memory corruption issue was addressed with improved memory handling. This issue is fixed in... 5.5 Medium
- apple ipados, macos, safari +30 more +32 more The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6,... 8.8 High
- laravel livewire Livewire vulnerable to remote command execution during property update hydration 9.2 Critical
- craft cms cms, craftcms craft cms +1 more Craft CMS Allows Remote Code Execution 10.0 Critical
- cisco secure firewall management center (fmc), secure firewall management center +1 more Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability 10.0 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 more Microsoft SharePoint Remote Code Execution Vulnerability 9.8 Critical
- zimbra collaboration, synacor zimbra collaboration suite (zcs), zimbra collaboration suite +2 more Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS... 7.2 High
- wftpserver wing ftp server, wing ftp server ftp server +1 more loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the... 4.3 Medium
- google chrome, chromium v8 +1 more Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote... 8.8 High
- google chrome, skia +1 more Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to... 8.8 High
- n8n n8n Vulnerable to Remote Code Execution via Expression Injection 10.0 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 more An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote... 8.6 High
- solarwinds web help desk SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability 9.8 Critical
- omnissa workspace one uem, vmware workspace one uem console +1 more VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0... 7.5 High
- apple ipados, ios and ipados, iphone os +2 more A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS... 7.8 High
- apple ipados, macos, safari +3 more +5 more A use-after-free issue was addressed with improved memory management. This issue is fixed in... 8.8 High
- apple ipados, macos, safari +9 more +11 more Moderate: webkit2gtk3 security, bug fix, and enhancement update 7.8 High
- rockwellautomation rslogix 5000, studio 5000 logix designer, rockwell multiple products +1 more +3 more Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions... 9.8 Critical
- hikvision ds-2cd2032-i firmware, ds-2cd2112-i firmware, ds-2cd2132-i firmware +56 more +58 more An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build... 9.8 Critical
- qualcomm 5g fixed wireless access platform firmware, apq8098 firmware, ar8031 firmware +236 more +238 more Integer Overflow or Wraparound in Graphics 7.8 High
- broadcom vmware aria operations, vmware aria operations, cloud foundation +3 more +5 more VMware Aria Operations command injection vulnerability 8.1 High
- cisco catalyst sd-wan manager, catalyst sd-wan controller and manager, sd-wan vbond orchestrator +1 more +3 more Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability 10.0 Critical
- cisco sd-wan, catalyst sd-wan manager, catalyst sd-wan +5 more +7 more Cisco SD-WAN Software Privilege Escalation Vulnerability 7.8 High
- soliton filezen FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is... 8.7 High
- bulwarkmail webmail Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)... 7.2 High
- bulwarkmail webmail, debian linux +1 more Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization 9.9 Critical
- dell recoverpoint for virtual machines, recoverpoint for virtual machines (rp4vms) +1 more Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded... 10.0 Critical
- gitlab When requests to the internal network for webhooks are enabled, a server-side request forgery... 6.8 Medium
- google chrome, chromium +1 more Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to... 8.8 High
- teamt5 threatsonar anti-ransomware TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload 7.2 High
- synacor zimbra collaboration suite Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed... 9.8 Critical
- Show olderLoading…