Known exploited vulnerabilities

Attackers can take over certain DrayTek network routers by sending a specially crafted web request, letting them control the device and potentially the entire…

Attackers can take control of an online commerce system to steal customer information or disrupt business operations

Attackers can remotely take control of vulnerable Ivanti traffic-management systems without knowing a password, potentially disrupting or tampering with…

Attackers can break into vulnerable Ivanti remote access appliances from the internet and potentially take them over if they are not updated

A vulnerable HugeGraph server can let an outside attacker take control of the machine without needing a password

An exposed Oracle application server can be taken over remotely without a password if it has not been patched. CVE-2022-21445 is rated critical (CVSS 9.8) and…

A serious flaw lets outsiders take over the server software without any login, so it must be fixed right away to stop attackers from stealing or disrupting…

A flaw in a reporting service lets attackers take over the server by sending bad web requests, and criminals are already using it to install ransomware

A flaw in older Adobe multimedia software lets attackers take control of computers when users view certain web content or files

A long-standing flaw in an outdated browser plugin can let attackers take over computers simply by getting a victim to view a malicious web page or file, and…

Old web animation software contains a flaw that lets attackers take full control of a computer when a user views a specially made animation file

Old Flash software on computers lets hackers take full control when someone views a specially made web animation, and attackers have already used this trick in…

Attackers can make malicious Windows content look trustworthy so people are more likely to open it, click it, or give up sensitive information

An exposed network monitoring system can let attackers steal password data and use it to break into systems or support ransomware attacks if it is not updated

A vulnerable Ivanti appliance can let an attacker who reaches its admin functions run commands on the device and potentially use it as a foothold into the…

A malicious Publisher document can bypass built-in Office protections and let attackers infect a computer if someone opens the file

A Windows flaw can let malicious downloaded files avoid normal safety warnings, making it easier for attackers to trick users into running harmful content

An attacker who has already gained basic access to a Windows computer can use this flaw to take full control of it unless the system is updated

Attackers are actively abusing a flaw in some SonicWall firewalls that can let them reach protected functions or crash the device, creating a serious risk of…

Older unpatched Linux systems can be taken over by an attacker who is already logged in, and criminals have used this weakness to install ransomware on victim…

A long-standing flaw in a widely used image-processing tool lets attackers take over computers simply by tricking the tool into opening a specially made…

A malicious spreadsheet can trick vulnerable WPS Office installations into running attacker code on a user’s computer

A vulnerable DrayTek management server can let outsiders download sensitive files without logging in, potentially exposing passwords and network device secrets

A vulnerable DrayTek management server can let outsiders download sensitive files without logging in. CVE-2021-20124 is rated high (CVSS 7.5), is listed in…

Attackers can abuse vulnerable Apache OFBiz systems to reach business application functions or data that should have been protected

A high-level user or exposed management system could be abused to upload a fake image that may let an attacker take control of the network management server

A person who can run limited code on an affected Linux machine may be able to turn it into full control of that machine

Attackers can break into vulnerable Dahua surveillance devices over the network without knowing the password, potentially exposing video, settings, and the…

Attackers can break into certain Dahua security cameras and recorders over the network without knowing a password, potentially letting them watch footage or…

A vulnerable server could let someone with powerful access run their own commands on it, putting data and service reliability at risk

A flaw in the help desk server software can let attackers take control of the server, so exposed systems should be patched and checked for compromise…

A Windows weakness can let malicious downloaded files open without the normal safety warning, making phishing and malware attacks more likely to succeed

A flaw in Windows can let someone who already has limited access to a computer take full control of it unless security updates are installed

A malicious project-planning document can take over an employee’s computer if opened on an unpatched Microsoft Project or Office installation

A flaw in software that processes scripts can let attackers take over a user’s computer if the user opens malicious content, so affected systems should be…

An attacker who already gets a basic foothold on an unpatched Windows computer can use this flaw to take full control of that machine

An attacker who already gets limited access to a vulnerable Windows computer can use this flaw to take full control of it, so affected systems need current…

A flaw in affected Linux kernels can let someone who already has limited access to a machine take full control of it or crash it

Attackers can break into vulnerable Apache OFBiz systems over the internet without a password and potentially take control of the application

A flaw in core Windows software lets attackers run any program they want on a computer if a user interacts with a specially crafted file or link

Attackers who gain enough control in the company directory can turn that access into full control of VMware servers and potentially shut down or encrypt many…

Some Acronis infrastructure systems can be taken over remotely if they still use built-in default passwords, putting critical storage and recovery services at…

A flaw in some ServiceNow versions could let an outside attacker take control of the platform and access or change important business data if it was not patched

An unpatched workflow platform could let an outsider take control of it remotely, putting business data and operations at risk

Attackers could check whether phone numbers used Authy, making targeted scams easier even though the accounts themselves were not broken into

Old versions of Internet Explorer contain a flaw that lets attackers take over a computer simply by getting the user to visit a malicious website

Attackers can remotely read sensitive files from vulnerable SolarWinds file-transfer servers, potentially exposing passwords and data needed for further…

A lower-level user may be able to read sensitive vCenter server files, which could help them gain broader access to the systems that manage virtual machines

Attackers can trick people on unpatched Windows systems into trusting malicious links or files that may lead to stolen passwords or malware

An attacker who already gets basic access to an affected computer can use this flaw to take full control of it