Do now Check the vendor's advisory for a fix and restrict administrative access to Barracuda products meanwhile. No vendor fix named: what this ticket lists is per the CVE record from Mandiant, not the vendor. Last checked 13 Nov, 16:26 UTC. Advisory
Fix found 13 Nov New that day
-
Barracuda Email Security Gateway Barracuda auth bypass & cmd inj none→ 9.4.0.030 KEV ✓ Record ✓ Vendor – -
WinRAR Remote code execution (exploited) Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 6 Nov, 20:18 UTC.KEV ✓ Record ✓ Vendor – -
QNAP Systems HBS 3 Remote code execution (exploited) Fixed in HBS 3 16.0.0415, HBS 3 v3.0.210411 +8 AdvisoryUnder the heat lamp: 10 days KEV ✓ Record ✓ Vendor ✓ -
Linux kernel Critical vulnerability Fixed in 7.1.10, 6.18.46 +5Under the heat lamp: 9 days KEV – Record ✓ Vendor ✓ -
Chrome Buffer overflow in Dawn Fixed in 157.0.8103.38Under the heat lamp: 9 days KEV – Record ✓ Vendor ✓ -
CryptoPayment Gateway CryptoPayment Gateway: RCE Do now Check the vendor's advisory for a fix, and restrict access to the CryptoPayment Gateway plugin's admin and endpoints until one is available. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓
Show the other 21
-
Elo (@enspirit/elo) Elo: sandbox escape to code execution Do now Check the Elo advisory for a fix and don't pass untrusted strings to Elo's parse, CLI or playground meanwhile. No vendor fix named: what this ticket lists is per GitHub advisory, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Google Android Android November updates Do now Check the vendor's advisory for a fix to the Android November vulnerabilities and restrict access to affected devices meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Subnet PowerSYSTEM Center Subnet PowerSYSTEM Center SQLi Do now Check the vendor's advisory for a fix and restrict network access to Subnet PowerSYSTEM Center meanwhile. No vendor fix named: what this ticket lists is per the CVE record from icscert, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Apache ZooKeeper Unauthenticated denial of service Do now Check the Apache ZooKeeper advisory for a fix and restrict network access to ZooKeeper meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache ZooKeeper Unbounded recursion via snapshot serialization Do now Check the Apache ZooKeeper advisory for a fix and restrict access to ZooKeeper servers meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache ZooKeeper SASL authorization bypass Do now Check the Apache ZooKeeper advisory for a fix and restrict network access to ZooKeeper meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache OpenOffice Out-of-bounds memory access Do now Check the Apache OpenOffice advisory for a fix and avoid importing WMF files from untrusted sources meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Apache OpenOffice Out-of-bounds write Do now Check the Apache OpenOffice advisory for a fix and avoid opening encrypted PDF files meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Apache OpenOffice Stack overflow Do now Check the Apache OpenOffice advisory for a fix and avoid opening untrusted documents with CFF fonts meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Apache ZooKeeper Denial of service via multiRead Do now Check the Apache ZooKeeper advisory for a fix and restrict clients that can send multiRead requests. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache OpenOffice Local file inclusion Do now Check the Apache OpenOffice advisory for a fix and avoid opening untrusted database files meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache OpenOffice Local file inclusion via GStreamer Do now Check the Apache OpenOffice advisory for a fix and restrict who can open untrusted documents meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Xen Arbitrary read/write via grant copy Do now Check the vendor advisory for a fixed version before you assume one exists. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor ✓ -
Apache OpenOffice Remote document loading Do now Check the Apache OpenOffice advisory for a fix and block loading remote documents from untrusted sources meanwhile. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
South Korean Presidential Office Data leak Do now Read the report and check whether South Korean Presidential Office affects you. Advisory -
Xsolis Data breach Do now Read the report and check whether Xsolis affects you. Advisory -
Binance $6.43B theft Do now Read the report and check whether Binance affects you. Advisory -
OpenVox RCE and client impersonation Do now Check the vendor advisory for a fixed version before you assume one exists. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record – Vendor – -
Apache Traffic Server Heap-buffer-overflow Do now Check the vendor advisory for a fixed version before you assume one exists. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record – Vendor ✓ -
BTCPay Server Bitcoin/Litecoin theft Do now Check the vendor advisory for a fixed version before you assume one exists. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record – Vendor ✓ -
Apple iPhone Apple: spyware notifications Do now Read the report and check whether Apple iPhone affects you. Advisory
Updated that day
-
WordPress WordPress: RCE vulnerability Fixed in 7.1.4 AdvisoryUnder the heat lamp: 14 days KEV ✓ Record ✓ Vendor ✓ -
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Fixed in 25.1.1.3, 22.8R2.6 AdvisoryUnder the heat lamp: 14 days KEV ✓ Record ✓ Vendor ✓ -
VMware Cloud Foundation Broadcom VMWare ESX Insufficient Logging Fixed in Cloud Foundation / vSphere Foundation (ESX) 9.1.x.x ESXi-9.1.0.0-25370933, Cloud Foundation / vSphere Foundation (ESX) 9.0.x.x ESXi-9.0.2.0100-25595025 +2 AdvisoryUnder the heat lamp: 16 days KEV ✓ Record ✓ Vendor ✓ -
Apache Struts Command Injection Fixed in org.apache.struts:struts2-core 2.3.28.1, org.apache.struts:struts2-core 2.3.24.3 +1 AdvisoryOn 2.3.20.x?Under the heat lamp: 36 days KEV ✓ Record ✓ Vendor ✓mvn versions:use-dep-version -Dincludes=org.apache.struts:struts2-core -DdepVersion=2.3.20.3 -DforceVersion=trueOn 2.3.24.x?mvn versions:use-dep-version -Dincludes=org.apache.struts:struts2-core -DdepVersion=2.3.24.3 -DforceVersion=true1 more release line -
Cisco Secure Email Gateway SQL Injection Fixed in 16.5.0-780, 16.0.4-302 +1 AdvisoryUnder the heat lamp: 60 days KEV ✓ Record ✓ Vendor ✓ -
zip-rs zip2 Zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per GitHub advisory, not the vendor. Last checked 11 Nov, 20:18 UTC. AdvisoryKEV – Record ✓ Vendor –
Show the other 13
-
OpenStack Manila Critical vulnerability Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per the CVE record from mitre, not the vendor. Last checked 10 Nov, 18:19 UTC.KEV – Record ✓ Vendor – -
XS-libbrotli XS::libbrotli: out-of-bounds write Do now Check the advisory for a fix and limit decoding of untrusted brotli input meanwhile. No vendor fix named: what this ticket lists is per the CVE record from CPANSec, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Spreadsheet-XLSX Spreadsheet::XLSX: code exec Do now Check the CPANSec advisory for a fix and avoid opening untrusted XLSX files with Spreadsheet::XLSX meanwhile. No vendor fix named: what this ticket lists is per the CVE record from CPANSec, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
Unknown Checkout Files Upload for WooCommerce: remote code execution Do now Check the vendor's advisory for a fix, disable the plugin meanwhile, and scan uploads for PHP files. No vendor fix named: what this ticket lists is per the CVE record from WPScan, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
zofe rapyd-admin Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability… Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per the CVE record from VulnCheck, not the vendor. Last checked 11 Nov, 21:17 UTC.KEV – Record ✓ Vendor – -
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per GitHub advisory, not the vendor. Last checked 10 Nov, 15:18 UTC.KEV – Record ✓ Vendor – -
Lean 4 Leanprover lean4: vulnerability (public PoC) Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per the CVE record from VulnCheck, not the vendor. Last checked 9 Nov, 20:17 UTC.KEV – Record ✓ Vendor – -
GNU mtools Out-of-bounds write Do now Check the vendor's advisory for a fix and avoid processing untrusted disk images with GNU mtools meanwhile. No vendor fix named: what this ticket lists is per the CVE record from mitre, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
http-session HTTP::Session: memcached cmd inj Do now Check the vendor's advisory for a fix and restrict access to memcached-backed session ids meanwhile. No vendor fix named: what this ticket lists is per the CVE record from CPANSec, not the vendor. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record ✓ Vendor – -
GPAC /MP4Box: buffer overflow Do now Check the advisory for a fixed version before you assume one exists. No vendor fix named: what this ticket lists is per the CVE record from mitre, not the vendor. Last checked 11 Nov, 02:18 UTC.KEV – Record ✓ Vendor – -
US Department of Defense US Defense Contractor: security incident Do now Read the report and check whether US Department of Defense affects you. Advisory -
Videostrong Android TV boxes Backdoor Do now Check the vendor advisory for a fixed version before you assume one exists. No fix named yet. Last checked 13 Nov, 16:26 UTC. AdvisoryKEV – Record – Vendor – -
European supermarkets Fridge cyberattacks Do now Read the report and check whether European supermarkets affects you. Advisory