Known exploited vulnerabilities
Under attack, per CISA.
- sudo, canonical ubuntu linux, debian linux +5 more +7 more Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a... 9.3 Critical
- adminer, debian linux +1 more SSRF in adminer 7.2 High
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +2 more +4 more A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA)... 6.5 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +2 more +4 more A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA)... 9.9 Critical
- google chrome, chromium v8, siemens cadra +2 more Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to... 9.8 Critical
- 3ds delmia apriso Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 9.0 Critical
- sitecore experience manager (xm), experience platform (xp), experience manager +4 more +6 more Sitecore Products ViewState Deserialization Vulnerability 9.0 Critical
- google android, android runtime +1 more In multiple locations, there is a possible way to escape chrome sandbox to attack android... 8.8 High
- debian linux, linux kernel +1 more posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() 7.8 High
- tp-link systems inc. archer c7(eu) v2, tl-wr841n/nd(ms) v9, tp-link archer c7 firmware +3 more +5 more Authenticated RCE via Parental Control command injection 8.6 High
- tp-link tl-wr841n, archer c5, archer c7 +55 more +57 more TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability 6.5 Medium
- facebook whatsapp business for ios, whatsapp for ios, meta platforms whatsapp +2 more +4 more Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to... 5.4 Medium
- tp-link tl-wa855re, tl-wa855re firmware +1 more TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same... 8.8 High
- elastic endpoint, sangoma freepbx +1 more FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE 10.0 Critical
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service 9.2 Critical
- git, apple xcode, debian linux +2 more Git allows arbitrary code execution through broken config quoting 8.1 High
- citrix session recording Limited remote code execution with privilege of a NetworkService Account access 5.1 Medium
- citrix session recording Privilege escalation to NetworkService Account access 5.1 Medium
- apple ipados, macos, ios and ipados +2 more +4 more An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in... 10.0 Critical
- trend micro apex one, trend micro, inc. micro apex one +1 more A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre... 9.4 Critical
- n-able n-central Insecure Deserialization Vulnerability 9.4 Critical
- n-able n-central Command Injection Vulnerability 9.4 Critical
- rarlab winrar, dtsearch +1 more Path traversal vulnerability in WinRAR 8.4 High
- microsoft internet explorer Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft... 9.3 High
- microsoft excel, office, access +11 more +13 more Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other... 9.3 High
- d-link dnr-322l, dlink dnr-322l firmware +1 more Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated... 8.8 High
- d-link dcs-2530l and dcs-2670l devices, dlink dcs-2530l firmware, dcs-2670l firmware +7 more +9 more An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02... 7.5 High
- d-link dcs-2530l and dcs-2670l devices, dlink dcs-2530l firmware, dcs-2670l firmware +7 more +9 more An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02... 8.8 High
- cisco identity services engine software, ise passive identity connector, identity services engine +1 more +3 more Cisco ISE API Unauthenticated Remote Code Execution Vulnerability 10.0 Critical
- cisco identity services engine software, identity services engine, identity services engine passive identity connector +2 more Cisco ISE API Unauthenticated Remote Code Execution Vulnerability 10.0 Critical
- papercut ng/mf, mf, ng +2 more PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF 8.4 High
- crushftp CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,... 9.0 Critical
- google chrome, chromium, apple ipados +8 more +10 more Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204... 8.8 High
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +3 more +5 more Microsoft SharePoint Server Spoofing Vulnerability 6.5 Medium
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 more Microsoft SharePoint Remote Code Execution Vulnerability 8.8 High
- sysaid, sysaid on-prem +1 more SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection 9.3 Critical
- sysaid, sysaid on-prem +1 more SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection 9.3 Critical
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 more Microsoft SharePoint Server Remote Code Execution Vulnerability 9.8 Critical
- fortinet fortiweb An improper neutralization of special elements used in an SQL command ('SQL Injection')... 9.6 Critical
- wftpserver wing ftp server, wing ftp server ftp server +1 more In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes,... 10.0 Critical
- citrix netscaler gateway, netscaler adc, gateway +2 more +4 more NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread 9.3 Critical
- synacor zimbra collaboration suite, zimbra collaboration suite (zcs) +1 more Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8... 7.5 High
- debian linux, fedoraproject fedora, opensuse leap +5 more +7 more Path Traversal in Action View 7.5 High
- multi-router looking glass project looking glass, looking glass multi-router looking glass (mrlg) +1 more fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause... 9.8 Critical
- php phpmailer, joomla joomla\!, wordpress +2 more Remote code execution in PHPMailer 9.8 Critical
- google chrome, chromium v8 +1 more Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform... 8.1 High
- smarsh telemessage, telemessage service, tm sgnl +2 more The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap... 4.0 Medium
- smarsh telemessage, telemessage service, tm sgnl +2 more The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap... 5.3 Medium
- citrix netscaler gateway, netscaler adc, gateway +2 more +4 more Memory overflow vulnerability leading to unintended control flow and Denial of Service 9.2 Critical
- ami megarac spx, megarac-spx, megarac sp-x +9 more +11 more Redfish Authentication Bypass 10.0 Critical
- Show olderLoading…