Known exploited vulnerabilities

A flaw in Windows can let someone who already gets onto a computer upgrade their access to take full control of it

An outdated remote-access device can be attacked over the internet to expose or alter sensitive access data, creating a serious risk of unauthorized entry and…

An exposed Confluence server may let outsiders read information they should not be able to access, increasing the risk of data theft and follow-on attacks

Attackers can quietly check what files exist on certain SonicWall network devices without needing a password, helping them plan bigger attacks

A flaw in Windows lets someone who already has limited access on a computer take complete control of it, which attackers have used to install ransomware

A problem in the graphics components of older Windows systems lets attackers who already have limited access on a computer take complete control of it

A bug in Windows graphics software lets someone already on a computer take complete control of it and has been used to spread ransomware

Older Windows computers contain a flaw that lets attackers who get a user to run a malicious program take complete control of the machine

Older versions of Internet Explorer can accidentally reveal private information from a user's computer when they visit a malicious website, allowing attackers…

A flaw in how certain older web browsers handle specific webpage styling and scripting lets attackers take over a user's computer simply by getting them to…

A problem in the browser's scripting engine lets attackers take control of a computer or crash it simply by getting someone to visit a malicious website

A flaw in Microsoft Edge lets attackers take over a computer or crash it simply by getting someone to visit a malicious website

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to…

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages…

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted…

Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1…

JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a…

Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized…

An old flaw in certain web browsers and email programs let attackers crash the software or take control of a user's computer simply by getting them to visit a…

Older versions of Java contain a flaw that lets attackers take full control of a computer simply by getting the victim to view a malicious image or webpage

A flaw in older Windows versions lets attackers who already have access to a computer take full control of it by messing with memory in the system driver

Old versions of Adobe Reader and Acrobat contain a flaw that lets attackers take over a computer simply by getting someone to open a specially made PDF file

Old versions of Internet Explorer contain a flaw that lets attackers take over a computer simply by tricking someone into visiting a malicious website

Opening a specially made document file in old versions of Microsoft Word can let attackers take over your computer

A flaw in an older Oracle single-sign-on system can send users to any website an attacker chooses, making it easier for criminals to trick people into…

A serious flaw in older Java software lets attackers take control of computers over the internet, so every organization must update Java right away to stop…

An old flaw in Adobe's Flash software can let attackers take over or crash computers when people view certain web content, and attackers are still using it

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel…

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista…

A flaw in certain Mitel communications systems can let outsiders misuse them to leak information or generate large amounts of attack traffic that disrupts…

Attackers can take control of vulnerable WatchGuard firewall devices from the internet, potentially giving them a path into the organization’s network

An attacker who already has basic access to a Windows machine can use the printing service to take full control of that machine

An outdated Sitecore website can let attackers take control of the server without needing a password, and this has been used in real attacks including…

A flaw in Citrix’s file-sharing controller can let outsiders break into the system without a password, potentially stealing or damaging business files

Older versions of QNAP's helpdesk tool contain a flaw that lets outsiders take over the software and steal or alter private information without needing any…

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer…

A turned-off security check in certain firewall login systems can let outsiders slip past authentication and reach sensitive company resources or take over…

Certain Juniper network devices can be tricked into revealing private files or letting outsiders take over their web management console if the web feature is…

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may…

Attackers can remotely take over certain older D-Link home and small-office routers without a password, potentially letting them spy on or disrupt your network…

Attackers can take over certain network appliances that manage company connections between locations, potentially disrupting operations or stealing data

A flaw in older Citrix SD-WAN products lets attackers remotely break into the system and steal or change data without needing any login credentials

A bug in the way older Windows versions handle graphics files can let an attacker take over a computer simply by getting the user to open a specially made…

Attackers can take over certain older LG network storage devices over the internet by sending specially crafted web requests, putting any data stored on them…

A flaw in Oracle reporting software lets anyone on the network change or read certain data without logging in, which could affect business reports and…

A flaw in older versions of Kentico lets attackers send a specially made request that tricks the server into running any code they choose, giving them full…

A flaw in how Windows handles certain files or links can let attackers take over a computer when a user clicks or opens something sent by email or a website

A flaw in how certain older web browsers process webpage code lets attackers take over a computer simply by getting someone to visit a malicious website