Known exploited vulnerabilities

A logged-in attacker can potentially take over the monitoring server and use it to steal data, disable alerts, or reach other systems

A logged-in attacker could use a flaw in the monitoring server to run commands on it, potentially stealing credentials and using it to reach other systems

A flaw in Oracle business intelligence software lets anyone on the internet read private company data without logging in

An attacker can upload malicious files to vulnerable FatPipe network appliances and potentially take control of systems that manage business connectivity

Attackers can abuse a flaw in VMware vCenter’s web gateway to reach internal management functions that should not be exposed

Attackers can remotely take over vulnerable Hikvision cameras if their management interfaces are exposed and not updated

Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page

A Windows flaw lets someone who already has limited access on a computer secretly gain full control, and criminals have used it to install ransomware on many…

A flaw in some network security software lets remote attackers run their own programs on the device without needing any login

Certain network security devices contain a flaw that lets outsiders change VPN passwords without logging in, potentially opening the door to private corporate…

A flaw in certain network devices can make their secure remote access features stop working when they process certain kinds of web page information, giving…

Attackers can remotely take over certain Oracle server software without logging in, putting business systems and data at risk of ransomware and theft

A serious flaw in an older web framework component lets attackers take over affected servers over the internet, and many organizations still need to install…

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers…

Attackers can secretly change trusted software so that harmful programs run on Windows computers without users realizing the files have been tampered with

A malicious link or attachment can trick Windows users into installing malware that may lead to data theft or ransomware

An attacker with access to manage a vulnerable Fortinet firewall could make it download untrusted files, potentially compromising a key network security device

A flaw in a widely used endpoint management server can let outsiders take control of it and potentially use it to reach many company computers

A widely used logging component can let attackers take over affected applications simply by getting them to record a malicious piece of text

Some network devices can be taken over remotely without a password, allowing attackers to install malware, disrupt service, or use the device to attack others

Attackers could reach inside the software repository system and steal or change important files without needing any password, putting company data and build…

A web server component can be tricked into running attacker code when it processes certain web requests, giving outsiders full control of the machine if the…

Attackers can send specially made data to an old JBoss server and take full control of it without needing any login

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression…

Attackers can break into vulnerable help desk systems over the internet without a password and take control of the server

An attacker could use an exposed help desk system without signing in, potentially viewing or changing sensitive support information

A chip flaw lets attackers who can run code on a device take full control by asking for too much memory at once

Flawed router software lets outsiders steal or alter important files, putting entire networks at risk of takeover

An unpatched email server can let an attacker with a valid login take control of it, steal mail, and help launch ransomware

A malicious spreadsheet can bypass Excel’s built-in protections and let an attacker take actions on a user’s computer if the file is opened

A flaw in Windows can let an attacker who already gets onto a computer take full control of it, making ransomware and data theft much easier

A vulnerable billing web application can let attackers break in without a password and install ransomware, so exposed systems must be patched or isolated…

An attacker who gets a vulnerable Apple device to run malicious code may be able to take complete control of the device

A vulnerable Yealink management server can be remotely taken over without a password, allowing attackers to control the system and disrupt operations

A vulnerable web server version can let outsiders read private server files or run commands, which can lead to data theft, outages, or ransomware

A flaw in VMware’s central virtualization management server can let an outside attacker take control of it and potentially disrupt many business systems at once

A malicious document can take over a Windows computer when opened, and attackers have used this weakness to spread malware and ransomware

A hidden management component on some Linux systems can let someone who already has limited access take full control of the machine if it is not updated

Attackers can take over vulnerable Linux systems running certain Microsoft management agents without needing a password

A hidden Microsoft management component on Linux systems can let someone who already has limited access take full control of the machine if it has not been…

A flaw in a common Linux management component can let someone who already has limited access take full control of the server

A flaw in Windows can let an attacker who already gets onto a computer take full control of it, which has been used in real attacks including ransomware…

A malicious Mac app could secretly access private data or device features that should have required the user’s permission

A malicious website could take control of an unpatched Apple device when someone opens it. CVE-2021-30663 is rated high (CVSS 8.8), affects LibRaw on…

A malicious Mac app could run even when Apple’s built-in safety checks should have blocked it, so unpatched computers may be compromised if a user opens the app

Opening a malicious webpage on an unpatched Apple device could let an attacker take control of the browser and potentially compromise the device

An iPhone that has not been updated could be taken over after the user opens a malicious web page or link. CVE-2021-30666 is rated high (CVSS 8.8), affects…

A malicious webpage could take control of an unpatched Apple device, so affected devices should be updated or replaced promptly

An outdated iPhone could be taken over simply by opening malicious web content, so affected devices must be updated or removed from use

A malicious web page could take control of an unpatched iPhone, so older devices need to be updated or replaced