Known exploited vulnerabilities

A flaw in VeraCore can let a logged-in attacker place malicious files where the web server may run or expose them

Attackers can remotely trick affected Ivanti management servers into revealing sensitive files, which may expose information needed to break further into the…

Attackers can remotely trick vulnerable endpoint management servers into revealing sensitive files, which may expose credentials and help them break further…

Attackers can remotely trick vulnerable Ivanti endpoint management servers into revealing sensitive files, which may expose information needed for broader…

A person who already controls a virtual machine could use this flaw to break out and run code on the computer hosting it, so VMware systems need urgent updates

A flaw in VMware ESXi can let an attacker break out of a virtual machine and potentially take control of the underlying server that runs many other systems

A person who already controls a virtual machine could make vulnerable VMware software reveal private memory from the system running that virtual machine

A flaw in Linux can let someone who already has access to a machine read pieces of protected system memory, which could help them break further into the device

Attackers can break into unpatched WhatsUp Gold monitoring servers without a password and use them to run commands and reach other systems

Some older Cisco small business routers can be taken over by anyone who has an admin login, and Cisco will not issue a fix, so they should be replaced or…

Attackers can bypass login protections on vulnerable Pentaho analytics servers and access or change business reporting data if the system is not updated

An attacker with powerful login access could abuse the analytics server to run their own commands and potentially take over the system

A flaw in Windows lets someone who already has limited access on a computer take complete control of it, and criminals are already using this to spread…

Attackers with a basic account can take over vulnerable Oracle Agile PLM systems, putting sensitive product and supply-chain information at risk

Attackers can remotely take over servers running older versions of Adobe ColdFusion software and run any commands they want

A logged-in attacker could read certain files from a vulnerable firewall’s management system, potentially exposing sensitive operational information

Attackers who have stolen a Craft website’s secret key can use this flaw to take over the site unless it is updated and the key is replaced

Attackers can get around the login page on vulnerable firewall management portals and access functions that should be restricted to administrators

A flaw in certain SonicWall remote-access VPN systems can let attackers get into a network without properly logging in, creating a serious ransomware risk

Attackers can remotely steal sensitive files from vulnerable SimpleHelp remote support servers, potentially giving them the passwords and access needed to…

Someone who gets physical access to an unpatched locked iPhone or iPad may be able to bypass protections that normally stop USB-based access to the device’s…

Some Mitel desk and conference phones can be taken over by someone with admin access, potentially disrupting calls or turning the phone into a foothold inside…

An attacker who already gets onto a Windows computer can use this flaw to take full control of it unless the system has been updated

A flaw in Windows can let someone who already gets onto a computer turn limited access into full control, so affected systems need the latest security updates

An attacker with a valid login could take control of the Cityworks web server unless the software is updated. CVE-2025-0994 is rated high (CVSS 8.8) and is…

A flaw in 7-Zip can let files from a downloaded archive open without the usual safety warnings, making it easier for attackers to trick users into running…

A malicious email can compromise a computer running vulnerable Outlook, potentially giving attackers access to the user’s messages, files, and company systems

A trusted Windows component used by some Dante software can be tricked into running an attacker’s file, potentially giving the attacker control of the computer

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely

A flaw in the firewall's remote-access bookmark feature lets outsiders take control of the device and the network it protects

A flaw in Linux webcam handling can let someone with local access or a malicious video device take over or crash a computer

Attackers can abuse an unpatched business application server to reach restricted functions without logging in and potentially take control of the system

A widely exploited software flaw can let attackers remotely expose sensitive information, so affected systems should be updated immediately

Attackers can create administrator accounts in the network monitoring tool without any login, giving them complete control over the system

Someone with administrator access to this network monitoring software can secretly run their own commands on the system and connected devices, risking complete…

Attackers have abused a flaw in Apple devices that can let a malicious app gain powerful control, so affected devices should be updated immediately

Attackers can break into vulnerable SonicWall remote access management appliances without a password and use them as a doorway into the organization

Attackers can take control of an exposed cloud networking controller without logging in, so affected systems need urgent patching and investigation

A flaw in Windows can let someone who already got limited access to a computer take full control of it, so affected systems should be patched urgently

An attacker who already gets onto a vulnerable Windows computer could use this flaw to gain full control of it, so affected systems should be updated promptly

Attackers with limited access to a Windows computer may be able to turn that access into full control unless the system is updated

Attackers can take full control of vulnerable Fortinet firewall or proxy devices without a password, which can let them break into the network and support…

A flaw in BeyondTrust remote access tools could let someone who already has administrator access run unauthorized commands and potentially take deeper control…

A flaw in Qlik Sense can let outsiders take control of the reporting server and disrupt or steal business data if it is not patched

A flaw in Ivanti remote-access gateways can let attackers break in without a password and use that access to steal credentials, enter the network, or support…

A flaw in Mitel’s collaboration system can let someone who already has administrator access read limited system information, which attackers have been seen…

A flaw in Mitel’s communications software can let outsiders access or damage messaging data and settings without logging in

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0…

Attackers can send malicious DNS traffic through some Palo Alto firewalls to make them reboot repeatedly and disrupt network access

A built-in password in the affected software can let outsiders break in, view or change sensitive records, and disrupt operations unless the software is…