Known exploited vulnerabilities

A flaw in the system used to manage company computers could let an outside attacker take control of it and potentially use it to affect many devices

Someone who already has basic access to a vulnerable remote desktop system may be able to turn that access into full control of the machine

An attacker who already has basic access to a vulnerable computer can use this flaw to take full control of it, so affected systems should be updated quickly

A local attacker can crash affected systems or remote access services, causing outages until the systems are patched or restarted

A flaw in a core Windows component can let an outsider take over a computer after someone opens something sent over the network, and attackers are already…

Attackers can trick someone into opening malicious web or document content that bypasses built-in protections and may lead to device compromise

A malicious document can trick the software into skipping a safety check, making it easier for attackers to compromise a user’s computer if the document is…

A flaw in affected mail servers lets outsiders run commands on the server without logging in, which can lead to data theft, outages, or ransomware

A development server used by React Native can let anyone who can reach it run programs on the developer’s machine, so exposed systems need to be patched and…

Attackers can break into vulnerable systems remotely without a password and take control of the server, so affected software should be updated or isolated…

An attacker with a valid admin login could abuse a FreePBX phone-system management feature to take control of the server and disrupt or manipulate calling…

An attacker could trick a vulnerable GitLab server into accessing private internal web addresses and potentially exposing sensitive information

Attackers can break into phone systems used by many businesses and take them over without a password, letting them make calls, listen in, or shut the system…

Attackers can break into vulnerable Ivanti mobile management servers from the network without a password and potentially take control of the system

A flaw in several Fortinet security products can let someone with their own FortiCloud account sign in to devices that belong to someone else when cloud…

Attackers are already abusing a flaw that can trick affected software into trusting unsafe files or actions, so systems should be updated quickly

Attackers can take over vulnerable mail servers by changing an administrator password without logging in, potentially gaining control of the entire server

Attackers can break into affected systems over Telnet without knowing a password, so exposed services should be disabled or updated immediately

Attackers can break into vulnerable mail servers without a password by uploading malicious files, potentially stealing email or deploying ransomware

A problem lets ordinary users on a computer run certain programs to secretly gain full administrator control, which attackers could use to take over the whole…

A flaw in VMware vCenter can let an attacker take control of the system that manages virtual servers if they can reach it over the network

Attackers can remotely trick vulnerable Zimbra webmail servers into revealing internal application files without needing to log in

eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

A trusted software dependency was poisoned so that installing certain versions could run malware on Windows build or developer machines

A weakness in the Versa Concerto management platform can let outsiders reach protected admin functions and steal sensitive information that may help them take…

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

A development web server could let outsiders read sensitive files from the machine if it is exposed and not updated

Attackers can break into vulnerable Cisco communications servers over the network without a password and potentially take control of the system

A person who already has access to a Windows computer could use this flaw to see information they should not be able to view, helping them carry out a larger…

Gogs vulnerable to a bypass of CVE-2024-55947

Attackers can abuse a flaw in Gogs to write files where they should not and potentially take control of the server that hosts source code

Attackers can take control of an HPE infrastructure management system remotely, potentially disrupting or manipulating the servers and equipment it manages

Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary…

Unsupported video recording devices can be remotely taken over if their management page is exposed, so they should be replaced or isolated immediately

Attackers can break into vulnerable WatchGuard firewall and VPN devices from the internet and potentially take control of them unless they are updated or…

A flaw in SonicWall remote access appliances can let someone with limited access gain control of the appliance and change important security settings

A flaw in Cisco email security appliances can let an outside attacker take full control of the device unless it is urgently updated or isolated

Some older ASUS update software was tampered with before delivery, so computers that installed it may have been silently compromised and should be checked and…

Attackers can break into affected Fortinet network devices without a password and take control unless the systems are updated or isolated

A malicious website or link could let attackers take control of unpatched Apple devices, so affected devices should be updated immediately

An exposed file-sharing server could let outsiders read sensitive files without logging in, so it needs to be updated urgently

Attackers with a password can upload programs to certain Sierra Wireless routers that then run on the device, giving them remote control of the equipment

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Attackers can abuse a mapping service feature to make the server reveal files, contact internal systems, or become unavailable

A flaw in Windows can let someone who already has limited access to a computer take full control of it, so affected systems need to be updated urgently

A malicious compressed file can make WinRAR place and run harmful files on a user's computer, so affected installations should be updated or removed quickly

Attackers can take control of vulnerable Array Networks gateway appliances unless they are updated promptly. CVE-2025-66644 is rated critical (CVSS 9.8) and is…

Some D-Link routers can be taken over remotely, so exposed devices should be updated, isolated, or replaced. CVE-2022-37055 is rated critical (CVSS 9.8), is…

React Server Components are Vulnerable to RCE

Attackers can take over vulnerable React-based web servers from the internet, so affected applications need to be updated and checked for compromise immediately

An attacker with a valid login can upload a malicious file to the monitoring system and use it to take control of the server

A flaw in OpenPLC ScadaBR can let an attacker plant malicious code in a settings page that runs when an operator or administrator opens it

A flaw in Oracle Identity Manager can let an outside attacker take control of the system that manages user access, so affected systems should be patched or…

A malicious website can take over an outdated browser, so affected systems should be updated urgently. CVE-2025-13223 is rated high (CVSS 8.8), affects…

Attackers with a valid login can abuse vulnerable FortiWeb systems to run commands on the appliance, potentially taking over a device that protects web…