Known exploited vulnerabilities

A flaw in an older web framework used by some business applications lets attackers take over the server remotely without any login, putting company data and…

Outdated Apple devices may let a malicious app get around built-in trust checks, increasing the risk of spyware or other unwanted software running on the device

Unpatched Apple devices could let an attacker who already gets a foothold take full control and steal sensitive information

An attacker who gets administrator access to the security management console could use it to run commands on the underlying Windows system, putting the…

A flaw in some MinIO storage systems can let someone with overly broad credentials upload files into storage areas they should not be able to access

Some older Samsung Android phones can be taken over by a malicious app unless they have received the vendor security update from January 2022 or later

A flaw in certain routers lets attackers who can reach the diagnostic page run their own commands on the device, which has already been used to spread…

Attackers can take over certain older routers from anywhere on the internet, potentially giving them access to everything on the connected network

A malicious PDF can take over a computer if opened with an outdated Adobe PDF reader. CVE-2023-26369 is rated high (CVSS 7.8), is listed in CISA KEV and is…

A malicious app on an unpatched Android device can silently bypass built-in protections and gain more control over the phone or tablet

Attackers can abuse vulnerable Cisco VPN systems to guess or reuse stolen logins and gain remote access to internal networks

An attacker who already has basic access to a computer may be able to turn that access into full control if the system is not updated

A malicious Word document can trick a computer into leaking login information to an attacker when someone opens or previews it

A malicious attachment could let an attacker take control of an unpatched Apple mobile device, so affected devices should be updated immediately

A malicious image could compromise an unpatched Apple phone, tablet, or computer simply when the device processes it

A malicious compressed file can make older WinRAR versions run malware when someone opens what looks like a harmless file inside it

Attackers can break into vulnerable Ivanti mobile gateway appliances without a password and potentially take control of them, so exposed systems need urgent…

Attackers can steal saved backup system passwords and use them to break into backup infrastructure, putting recovery from outages or ransomware at risk

A vulnerable server can be taken over remotely by an attacker without needing a password or anyone to click anything

An exposed file-sharing server can be taken over remotely without a password, allowing attackers to steal files or use the server as a foothold into the…

Attackers can remotely knock vulnerable .NET-based services offline, so affected systems need to be updated promptly

Certain older routers contain a flaw that lets outsiders run commands on the device without any login, which can let attackers seize control of home or office…

A flaw in Ivanti’s mobile management server can let someone with admin access place malicious files on the system and potentially take it over

Some Apple devices need updates because a malicious app could gain deeper control over the device than it should have

Attackers can break into vulnerable Ivanti mobile-management servers without a password and potentially steal or change sensitive company device and user…

Attackers can reach parts of the ColdFusion administration area that should be protected, which may expose sensitive settings and help them break further into…

A flaw in Adobe ColdFusion can let outsiders reach sensitive administration pages without signing in, increasing the risk of data exposure or deeper server…

Attackers can break into vulnerable Citrix remote-access appliances from the internet without a password and use them as a doorway into the organization

A malicious document or link can let attackers take over a user's computer, and this issue has already been used in real attacks including ransomware campaigns

Attackers can remotely take control of vulnerable solar monitoring devices if their web management interface is exposed

An attacker who already gets limited access to a Windows computer can use this flaw to take full control of it if the system is not updated

Attackers can send a specially crafted Outlook item that tricks the app into skipping important safety warnings, making phishing and malware attacks more…

Attackers can trick someone into opening a malicious file that avoids normal Windows safety warnings and can lead to malware running on the device

An attacker who tricks someone into opening malicious content on an unpatched Windows computer could gain full control of that computer

Attackers can remotely take over affected Netwrix auditing systems and the computers they monitor, which can lead to data theft or ransomware if not fixed

Affected devices can let a malicious app or user take full control of the device, so they should be updated with the vendor’s security fix

Older Samsung-based Android devices can be forced to crash by a malicious app or process that has special phone-radio access, so they should be updated or…

An outdated Samsung mobile device could be taken over by a malicious app or attacker who already has limited access to the device

Some older Samsung Android phones have a known exploited flaw that could let an already deeply compromised device bypass built-in safety checks unless the…

Some older Android phones can be taken over more deeply if an attacker has already gained privileged access, so affected devices should be updated or replaced

Some older Samsung devices allowed a highly privileged attacker to run unauthorized code inside a phone hardware component, so affected devices need vendor…

Some older Samsung Android devices have a flaw in a built-in hardware driver that attackers have used to gain deeper control of already compromised phones, so…

Certain older D-Link wireless access points can be tricked by someone who already has login access into running unauthorized commands that could let attackers…

Certain older D-Link Wi-Fi routers contain a flaw that lets anyone on the same network take complete control of the router without a password

Attackers can use this Apple device flaw to gain powerful control over unpatched devices, so affected iPhones, iPads, Macs, and Watches should be updated…

Attackers can break into vulnerable Zyxel network storage devices over the internet without a password and take control of the data and device

If a virtualization host is taken over, outdated VMware guest tools can let the attacker more easily access or change data inside the virtual machines running…

An attacker can take over an unpatched network-visibility appliance remotely and use it to steal sensitive operational information or move deeper into the…

A flaw in how certain web graphics are handled lets attackers steal private information from users who visit malicious websites, and the issue has already been…

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows…