Known exploited vulnerabilities
Under attack, per CISA.
- d-link dir-859, dir-859 router, dlink dir-859 firmware +2 more D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal 5.3 Medium
- fortinet fortios, fortigate +1 more Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup... 6.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +5 more +7 more A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid... 7.8 High
- apple ipados, macos, visionos +4 more +6 more This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS... 4.2 Medium
- tp-link multiple routers, tl-wr740n firmware, tl-wr841n firmware +1 more +3 more TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a... 8.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Internet Shortcut Files Remote Code Execution Vulnerability 8.8 High
- wazuh, wazuh server +1 more Remote code execution in Wazuh server 9.9 Critical
- erlang erlang/otp, otp, cisco cloud native broadband network gateway +22 more +24 more Erlang/OTP SSH Vulnerable to Pre-Authentication RCE 10.0 Critical
- roundcube webmail A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a... 9.3 Critical
- google chrome, chromium v8, microsoft edge chromium +2 more Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote... 8.8 High
- qualcomm aqt1000 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +74 more +76 more Incorrect Authorization in Graphics 8.6 High
- qualcomm ar8031 firmware, csra6620 firmware, csra6640 firmware +43 more +45 more Use After Free in Graphics 7.5 High
- qualcomm aqt1000 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +75 more +77 more Incorrect Authorization in Graphics Windows 8.6 High
- craft cms, craftcms craft cms +1 more Craft CMS stores user-provided content in session files 6.9 Medium
- connectwise screenconnect ScreenConnect Exposure to ASP.NET ViewState Code Injection 8.1 High
- craft cms cms, craftcms craft cms +1 more RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms 9.3 Critical
- asus rt-ax55, rt-ax55 routers, rt-ax55 firmware +2 more ASUS RT-AX55 v3.0.0.4.386.51598 was discovered to contain an authenticated command injection... 8.8 High
- asus gt-ac2900 firmware, lyra mini firmware, routers +2 more The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows... 9.8 Critical
- samsung magicinfo 9 server Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9... 9.8 Critical
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more Remote Code Execution 7.2 High
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 more Authentication Bypass 5.3 Medium
- srimax output messenger Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper... 7.2 High
- mdaemon email server, mdaemon +1 more Stored XSS vulnerability in MDaemon Email Server 5.3 Medium
- zimbra collaboration, synacor zimbra collaboration suite (zcs) +1 more An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS)... 6.1 Medium
- zkteco biotime A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated... 7.5 High
- sap netweaver, sap se netweaver (visual composer development server) +1 more Insecure Deserialization in SAP NetWeaver (Visual Composer development server) 9.1 Critical
- draytek vigor2960, vigor300b, vigor routers +2 more +4 more DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection 6.9 Medium
- fortinet forticamera, fortimail, fortindr +4 more +6 more A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0... 9.6 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Scripting Engine Memory Corruption Vulnerability 7.5 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 more Windows Common Log File System Driver Elevation of Privilege Vulnerability 7.8 High
- microsoft windows, windows 10 version 1809, windows 10 version 21h2 +18 more +20 more Microsoft DWM Core Library Elevation of Privilege Vulnerability 7.8 High
- telemessage archiving backend, tm sgnl, text message archiver +2 more The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM... 1.9 Low
- geovision gv-dsp lpr firmware, gv-dsp lpr v3, gv-dsp lpr v3 firmware +10 more +12 more GeoVision EOL devices - OS Command Injection 9.8 Critical
- geovision gv vs04a, gv vs04h, gv-bx130 firmware +56 more +58 more GeoVision EOL device - OS Command Injection 9.8 Critical
- freetype, debian linux +1 more An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font... 8.1 High
- langflow Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code 9.8 Critical
- commvault command center, command center innovation release, commvault +2 more Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal 9.3 Critical
- yiiframework yii yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key 9.0 Critical
- apache http server, netapp ontap 9, sonicwall sma 200 firmware +4 more +6 more Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. 9.1 Critical
- sonicwall sma100, sma100 appliances, sma 200 firmware +4 more +6 more Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a... 7.2 High
- sap netweaver, sap se netweaver (visual composer development server) +1 more Missing Authorization check in SAP NetWeaver (Visual Composer development server) 10.0 Critical
- commvault, commvault web server +1 more Commvault Web Server unspecified vulnerability 8.7 High
- broadcom brocade fabric os, brocade fabric os, broadcom fabric operating system +2 more Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6 8.6 High
- qualitia active! mail, qualitia co., ltd. active! mail 6, qualitia active\! mail +2 more Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow... 9.8 Critical
- apple ipados, macos, tvos +4 more +6 more This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 18.4.1,... 9.8 Critical
- apple ipados, macos, tvos +5 more +7 more A memory corruption issue was addressed with improved bounds checking. This issue is fixed in... 9.8 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +31 more +33 more NTLM Hash Disclosure Spoofing Vulnerability 6.5 Medium
- sonicwall sma100, sma100 appliances, sma 200 firmware +4 more +6 more Improper neutralization of special elements in the SMA100 management interface allows a remote... 6.5 Medium
- Show olderLoading…