Every flaw we've listed
106 vulnerabilities attackers have used, newest first. The live board shows the last 90 days; this page keeps them all.
- Linux KernelLinux Kernel Missing Initialization of a Variable Vulnerability
- Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability
- Adobe Commerce / MagentoHackers have broken into hundreds of online stores through a Magento upload flaw
- Brotli / Node.jsA bug in a common compression library puts Node.js apps at risk
- PHPTwo PHP flaws let attackers take over web servers with no login
- PHPTwo PHP flaws let attackers take over web servers with no login
- Arista VeloCloud OrchestratorArista VeloCloud Orchestrator SQL Injection Vulnerability
- Collabora Collabora Online – Built-in CODE ServerCollabora Online – Built-in CODE Server OS Command Injection Vulnerability
- Plex Media ServerPlex Media Server External Control of File Name or Path Vulnerability
- Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Plex Media ServerPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- Plex Media ServerPlex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Siemens Software CenterSiemens Software Center Uncontrolled Search Path Element Vulnerability
- EG Secure Solutions SiteGuard Server EditionEG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
- BeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Fortinet Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability
- Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- Cisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal Vulnerability
- Ahsay AhsayCBSAhsay AhsayCBS Command Injection Vulnerability
- Ahsay AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability
- Palo Alto Networks PAN-OSPalo Alto Networks PAN-OS Code Injection Vulnerability
- WindowsA Windows flaw lets booby-trapped files skip the “Are you sure?” warning
- Ivanti Connect SecureAn Ivanti VPN flaw lets attackers in without a password
- Strapi StrapiStrapi Cleartext Storage of Sensitive Information Vulnerability
- ONLYOFFICE DocsONLYOFFICE Docs Server Path Traversal Vulnerability
- Apache StrutsApache Struts Command Injection Vulnerability
- ISC BIND ISC BIND Data Processing Errors Vulnerability
- ProFTPD ProFTPDProFTPD Improper Access Control Vulnerability
- Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Zammad GmbH ZammadZammad GmbH Zammad Improper Privilege Management Vulnerability
- Zammad GmbH ZammadZammad GmbH Zammad Session Fixation Vulnerability
- Fortinet FortiMailFortinet FortiMail Path Traversal Vulnerability
- Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- iPhone, iPad & MacApple fixes a flaw used in targeted attacks on iPhones and Macs
- Citrix NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Citrix NetScalerCitrix NetScaler Improper Input Validation Vulnerability
- WordPress CoreWordPress Core Remote File Inclusion Vulnerability
- MikroTik RouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- Microsoft SharePointMicrosoft SharePoint Code Injection Vulnerability
- Adobe Commerce and Magento Adobe Commerce and Magento Incorrect Authorization Vulnerability
- WSO2 Multiple ProductsWSO2 Multiple Products Path Traversal Vulnerability
- F5 BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Arista VeloCloud OrchestratorArista VeloCloud Orchestrator Improper Input Validation Vulnerability
- Check Point Multiple ProductsCheck Point Multiple Products Path Traversal Vulnerability
- Check Point Multiple ProductsCheck Point Multiple Products Improper Certificate Validation Vulnerability
- Zyxel GS1900 Series SwitchesZyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- Linux KernelLinux Kernel Out-of-Bounds Write Vulnerability
- Linux KernelLinux Kernel Race Condition Vulnerability
- Linux KernelLinux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- Acronis BackupAcronis Backup Incorrect Default Permissions Vulnerability
- Cisco Identity Services EngineCisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- Google PixelGoogle Pixel Improper Authorization Vulnerability
- Cisco Secure Email GatewayCisco Secure Email Gateway SQL Injection Vulnerability
- GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- ConnectWise ScreenConnectConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- JFrog ArtifactoryJFrog Artifactory Improper Authentication Vulnerability
- JFrog ArtifactoryJFrog Artifactory Incorrect Authorization Vulnerability
- MikroTik RouterOSMikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- MikroTik RouterOSMikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- Google Chromium V8Google Chromium V8 Out of Bounds Write Vulnerability
- Cisco Secure Firewall Management CenterRansomware groups are exploiting a perfect-10 Cisco firewall flaw
- Citrix NetScalerA Citrix NetScaler login bypass has no workaround
- Fortinet FortiGateAttackers are hijacking unpatched FortiGate firewalls at scale
- N-able N-centralN-able N-central Static Code Injection Vulnerability
- Microsoft WindowsMicrosoft Windows Heap-Based Buffer Overflow Vulnerability
- Microsoft WindowsMicrosoft Windows Link Following Vulnerability
- Adobe Commerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
- Google ChromeChrome's sixth zero-day of the year is patched
- Sangoma SwitchvoxSangoma Switchvox SQL Injection Vulnerability
- SonicWall SMA1000 AppliancesSonicWall SMA1000 Appliances OS Command Injection Vulnerability
- SonicWall SMA1000 AppliancesSonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- JFrog ArtifactoryJFrog Artifactory Improper Authentication Vulnerability
- BerriAI LiteLLMBerriAI LiteLLM Improper Authentication Vulnerability
- Kestra Kestra OSSKestra OSS OS Command Injection Vulnerability
- Kludex StarletteKludex Starlette HTTP Request/Response Smuggling Vulnerability
- PaperCut NG/MFPaperCut NG/MF Unsafe Reflection Vulnerability
- PaperCut NG/MFPaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- JFrog ArtifactoryJFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Linux KernelLinux Kernel Unspecified Vulnerability
- ownCloud ownCloudownCloud Improper Authentication Vulnerability
- Citrix NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Linux KernelLinux Kernel Out-of-Bounds Write Vulnerability
- Ajax.NET Professional Ajax.NET ProfessionalAjax.NET Professional Deserialization of Untrusted Data Vulnerability
- Microsoft SQL ServerMicrosoft SQL Server Remote Code Execution Vulnerability
- Red Hat Automatic Bug Reporting ToolRed Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- Red Hat LibuserRed Hat Libuser Race Condition Vulnerability
- Gitea GiteaGitea Code Injection Vulnerability
- Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-inOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- Synacor Zimbra Collaboration Suite (ZCS)Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- TrueConf ServerTrueConf Server Code Injection Vulnerability
- TrueConf ServerTrueConf Server Missing Authentication for Critical Function Vulnerability
- MLflow MLflowMLflow Server-Side Request Forgery Vulnerability
- Apple macOSApple macOS Improper Authentication Vulnerability
- Broadcom VMware vCenterBroadcom VMware vCenter Path Traversal Vulnerability
- Microsoft SharePointMicrosoft SharePoint Weak Authentication Vulnerability
- Microsoft Internet Key Exchange (IKE) Service ExtensionsMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
- Ray-Project RayRay-Project Ray Code Injection Vulnerability
- Metabase MetabaseMetabase SQL Injection Vulnerability
- Microsoft Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
- Progress LoadMasterProgress LoadMaster Command Injection Vulnerability
- JetBrains TeamCityJetBrains TeamCity Deserialization of Untrusted Data Vulnerability
- IBM LangflowIBM Langflow Code Injection Vulnerability
- Apache TomcatApache Tomcat Missing Encryption of Sensitive Data Vulnerability
- N-able N-centralN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
- N-able N-centralN-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability