Known exploited vulnerabilities

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to…

A flaw in Apple device software could let a malicious app take full control of an unpatched iPhone, iPad, or Mac

An attacker who already gets limited access to a Windows computer can use this flaw to take full control of it unless the system is patched

Attackers can break into exposed QNAP photo-sharing storage devices and tamper with files, potentially leading to outages or ransomware

A vulnerable router can be taken over remotely, allowing attackers to disrupt connectivity, change network settings, or use it as a doorway into the network

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6…

A configuration flaw in certain network security devices can let attackers steal the usernames and passwords those devices use to talk to user directories…

A serious flaw in Oracle WebLogic server lets outside attackers take over the entire server without any login, risking data loss and major service outages

A flaw in certain router software lets remote attackers break in without a password and take full control of the device

Attackers can remotely take over certain old D-Link home routers and run any commands they choose, letting them spy on or hijack connected networks

Certain older routers can leak their administrator password to anyone who visits their web page and follows a simple recovery link, letting attackers take full…

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to…

A malicious project file can take over an engineer’s DOPSoft workstation if opened in an outdated version of the software

Older Apple devices could let malicious software break out of its safety limits and do more on the device than it should

A misconfigured firewall can be tricked into helping flood someone else’s network with traffic, making the attack look like it came from your organization

An attacker could use a flaw in older Apple software to take deep control of a device after a user runs or opens malicious content

A malicious webpage can take control of an unpatched device or app that uses Apple’s web browsing engine, so affected systems should be updated immediately

A regular domain account may be able to abuse Windows certificate services to take over the entire company Windows domain if systems are not patched and…

A flaw in SAP web-facing systems can let an outside attacker make the system treat malicious requests as if they came from a legitimate user, potentially…

An unpatched system can be taken over if a user is tricked into opening or interacting with malicious content. CVE-2022-21971 is rated high (CVSS 7.8), is…

Attackers can take complete control of certain older firewall systems over the internet, putting entire networks at risk of breach

A malicious file can abuse a Windows troubleshooting tool to run an attacker’s code if someone opens it. CVE-2022-34713 is rated high (CVSS 7.8) and is listed…

A malicious compressed file can make vulnerable Linux or UNIX systems write attacker-controlled files in sensitive places, potentially giving attackers access…

A vulnerable Confluence add-on created a hidden account with a known password, allowing outsiders to log in and read internal wiki content

A flaw in Windows can let someone who already gets limited access to a computer take full control of it unless the system is patched

Attackers can abuse a Windows authentication weakness to pretend to be trusted systems or users and gain unauthorized access inside a company network

An exposed Mitel phone-system appliance can be taken over remotely, potentially letting attackers disrupt communications and use it as a starting point for…

An attacker who already has basic access to a Linux machine can use this flaw to become a full administrator and take over the system

Older iPhones and iPads can be taken over by a malicious app, so they should be updated immediately. CVE-2021-30983 is rated high (CVSS 7.8), is listed in CISA…

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be…

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS…

Bad apps can secretly take full control of certain Apple phones, computers, and watches, so updating them right away stops attackers who are already using this…

A flaw in older Apple devices could let attackers take over the device after a user opens something malicious, potentially stealing data or installing unwanted…

A malicious document can make Windows run attacker commands, which may let criminals take over a computer and deploy malware or ransomware

A regular SAP user could upload a harmful file that lets them take over the SAP application server and disrupt or change critical business systems

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka…

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified…

Attackers can remotely take over certain QNAP storage devices, steal or lock up files, and this weakness is already being used by ransomware gangs

Attackers can reach inside QNAP photo-management software and steal or change important files on the device, a weakness already used by ransomware groups to…

Attackers can reach inside QNAP devices that run Photo Station and steal or change important files without any password

A flaw in QNAP photo software lets outsiders break in without permission, potentially stealing or locking up company files, and attackers are already using it…

Attackers who already have login access can seize full control of certain older Cisco small-business routers and use them to break into the rest of the network

Older versions of Chrome could be tricked by a specially made webpage into crashing or letting attackers run harmful code inside the browser

A bug in an old version of Chrome lets attackers run their own programs on a user's computer simply by getting the user to visit a harmful web page

A flaw in how web browsers handle certain code on malicious websites can let attackers take over a user's computer if they visit the wrong page

A problem in Chrome's JavaScript engine lets attackers run their own code on a user's computer simply by getting the user to visit a specially made webpage

A flaw in a common software library could let attackers take over computers by opening a bad file, so organizations should update the library without delay

A bug in how web browsers handle certain code on websites could let attackers take control of a user's computer simply by getting them to visit a malicious page

Attackers can seize control of certain older NETGEAR home routers over the internet and use them to spy on or attack connected networks