Known exploited vulnerabilities
Under attack, per CISA.
- d-link routers, dlink go-rt-ac750 firmware +1 more D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer... 9.8 Critical
- facebook react, meta react server components, react-server-dom-parcel +3 more +5 more React Server Components are Vulnerable to RCE 10.0 Critical
- openplc scadabr OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated... 8.8 High
- android framework, google android +1 more In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a... 5.5 Medium
- android framework, google android +1 more In multiple locations, there is a possible way to launch activities from the background due to a... 7.8 High
- openplc scadabr OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via... 5.4 Medium
- opentext identity manager, oracle fusion middleware +1 more Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST... 9.8 Critical
- google chrome, chromium v8, siemens cadra +2 more Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to... 8.8 High
- fortinet fortiweb An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')... 6.7 Medium
- fortinet fortiweb A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0... 9.4 Critical
- microsoft windows, windows 10 version 1809, windows 10 version 21h2 +18 more +20 more Windows Kernel Elevation of Privilege Vulnerability 7.0 High
- gladinet triofox Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw... 9.1 Critical
- watchguard firebox, fireware, fireware os +2 more WatchGuard Firebox iked Out of Bounds Write Vulnerability 9.3 Critical
- samsung android, mobile devices, samsung mobile devices +2 more Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote... 8.8 High
- gladinet centrestack, centrestack and triofox, triofox +2 more Gladinet CentreStack and TrioFox Local File Inclusion Flaw 7.5 High
- centos-webpanel centos web panel, cwp control web panel, control-webpanel webpanel +2 more CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote... 9.0 Critical
- broadcom vmware aria operations and vmware tools, vmware aria operations, tools +7 more +9 more VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) 7.8 High
- xwiki platform, xwiki, xwiki xwiki-platform +2 more Remote code execution as guest via SolrSearchMacros request in xwiki 9.8 Critical
- 3ds delmia apriso Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 9.1 Critical
- 3ds delmia apriso Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 8.0 High
- microsoft windows, windows server 2012, windows server 2012 (server core installation) +11 more +13 more Windows Server Update Service (WSUS) Remote Code Execution Vulnerability 9.8 Critical
- adobe commerce, commerce and magento, commerce b2b +1 more +3 more Adobe Commerce | Improper Input Validation (CWE-20) 9.1 Critical
- motex lanscope endpoint manager, motex inc. lanscope endpoint manager (on-premises) (client program (mr) and detection agent (da)) +1 more Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly... 9.3 Critical
- oracle configurator, e-business suite +1 more Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime... 7.5 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows SMB Client Elevation of Privilege Vulnerability 8.8 High
- kentico xperience, xperience cms +1 more Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass 9.8 Critical
- kentico xperience, xperience cms +1 more Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass 9.8 Critical
- apple ipados, macos, safari +5 more +7 more The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8... 8.8 High
- adobe experience manager, experience manager (aem) forms, experience manager forms +2 more Adobe Experience Manager | Incorrect Authorization (CWE-863) 10.0 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +35 more +37 more Windows Remote Access Connection Manager Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +34 more +36 more Windows Agere Modem Driver Elevation of Privilege Vulnerability 7.8 High
- igel os, microsoft windows 10 1507, windows 10 1607 +13 more +15 more In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly... 4.6 Medium
- sky co., ltd. skysea client view, skysea client view +1 more SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in... 9.8 Critical
- grafana Grafana path traversal 7.5 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 more An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site... 5.4 Medium
- oracle concurrent processing, e-business suite +1 more Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component:... 9.8 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +39 more +41 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- broadcom fabric operating system, linux kernel, netapp aff 500f firmware +18 more +20 more Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE 8.3 High
- microsoft windows, windows 7, windows 8 +8 more +10 more The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2... 8.8 High
- microsoft windows, windows 7, windows server 2003 +3 more +5 more Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode... 8.8 High
- microsoft internet explorer Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers... 9.3 High
- mozilla firefox, seamonkey, thunderbird +1 more +3 more Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and... 9.3 High
- samsung android, mobile devices, samsung mobile devices +2 more Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote... 8.8 High
- smartbedded meteobridge, meteobridge firmware, meteobridge vm +2 more Arbitrary Command Injection in Smartbedded MeteoBridge 8.7 High
- jenkins, oracle communications cloud native core automated test suite +1 more Deserialization of Untrusted Data in Jenkins 9.8 Critical
- juniper screenos Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b,... 9.8 Critical
- gnu bash GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of... 10.0 High
- cisco ios xe software, ios, ios xe +3 more +5 more A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software... 7.7 High
- libraesva email security gateway Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail... 6.1 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 more Deserialization Vulnerability in GoAnywhere MFT's License Servlet 10.0 Critical
- Show olderLoading…