Vulnerabilities that CISA lists as exploited in the wild (the Known Exploited Vulnerabilities catalog) and CISA's cybersecurity advisories, collected daily and quoted with a link to the source. These events are not matched to your stack: an entry does not mean you are affected, and a missing entry does not mean you are safe. Required actions and due dates are CISA's, written for U.S. federal civilian agencies.
For the open-source packages you run, the advisory feed has affected versions and fixes, and your stack matches them to your exact versions.
News — advisory watch
These reports lack affected versions, a fix or verified evidence, so they aren’t in Actionable. See each source for details.
--- _-= Per source details. Do not edit below this line.=-_ Source: ossf-package-analysis (fc78014eaba6dbdc0a485f1954874cbfa65b71ffcda55b1b9337807004e42a2f) The OpenSSF Package Analysis project identified 'rcp-ndcg' @ 9999.0.0 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: kam193 (5f7d32ed4f94170c5bd90f8123b2b328eb13b13fad22690cce67dde42281cb23) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (dac6ac53c8961ddeb27c7cc0db7ffce9f909fc4001c278089743dc8efcd364e6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (4e3377cad63646a32d0df81b528479fb967ecde0ba1eebf435e3adda1da96911) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (ae8dcee071dacb90e806d5a7864adf0ce140713e4f83f2e6a5804b1afb1bcce3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (4a1268262a3d83338b1943ef3df173acf8c772c4491952f40de77e34aa54c341) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (f23b7276730ee41471843bc482c4ee3a68f288f8e625591d38b7cc478ab68b80) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (5a1d1c16da2b41ce6608187b251365bb923672ed0412858480e99ae43f94d8ab) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (1622f86127a25f1b5ebeee0530d41334242f185d382409e441058956299e3c48) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (592383fdf95ac0e0957f7c750b7063dda5d2428a36d783277918aa7501ed63c2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (c898b43dd1ee0f1e9f5583261609fccdada1f1612e591381e05c64e032627e04) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (92a89da483ef76193feafa163b5348fafe010999ac2e73154f9c9b3f33d07783) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (1abcd7d676a10de9db64d9be6dd532ceee0558062f45ddfb5f6137cb8ba8467b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (5a0da0aa5320d070b240dec07b393270995c492fb5ed23c7dcf8ae077583a409) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (6b9e3f519363694211241ddf83d95c5f75a4f22ef9b5f60e2e962c01f97ddd25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (380de9c4bebb6dbe605106630c161af02376f67c9810af146258afeabbafb901) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (fbb9b2ba8ffb0896aa285d4529591fddeb3c430a82f7dd72f0bd95764dcea64a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (42e388478673b3533017aa796ce12bc8ad4dd61aa34ca7d0ad82417066573900) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (8da55a3bfba13507a552e0ed24d0aa8ac426e9b50055661ee71ea6c951830b30) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (ab42798fc40b5b8c35b36e9aab872128a0a06d4f385d2aa56e59bfbf843482f6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (7795c5ecb71c77fcb6d7630bfb136c7edef41a13036dd6ae6ebb02dfe4b60618) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (49fd943e46e5ed64d42a0d3ea9dda036ad44eeeccf2e4b9b4c90ac243ba5bb78) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (585289d80a705650a586dbdc453c0d5a6ed2399a338bf1309dfff7e41a804472) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (28d56828b44836f8b55e591ad433f8b082433589f3275c892174bac0ac562ac6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
--- _-= Per source details. Do not edit below this line.=-_ Source: ghsa-malware (53f6b94af70b225ed3a3ee0edfa4db2469ca84bf27e23e46b61addcdabac9349) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Showing the latest 25 of 7326 advisory news reports.
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
CISA's required action · due for U.S. federal civilian agencies
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.