Latest high and critical flaws
- CVE-2018-25404 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25403 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25402 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25401 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25400 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25399 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2018-25398 The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciouHigh 8.8 · May 29, 2026
- CVE-2026-48249 Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not settinHigh 8.2 · May 21, 2026
- CVE-2026-48248 Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_High 8.2 · May 21, 2026
- CVE-2026-48247 Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLHigh 8.2 · May 21, 2026
- CVE-2026-48246 Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSHigh 8.2 · May 21, 2026
- CVE-2026-48242 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.Critical 9.2 · May 21, 2026
- CVE-2026-48241 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source Critical 9.2 · May 21, 2026
- CVE-2026-48240 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated iHigh 7.1 · May 21, 2026
- CVE-2026-48239 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clausHigh 7.1 · May 21, 2026
- CVE-2026-48238 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause High 7.1 · May 21, 2026
- CVE-2026-48237 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated iHigh 7.1 · May 21, 2026
- CVE-2026-48236 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser,High 7.1 · May 21, 2026
- CVE-2026-48235 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestampHigh 8.8 · May 21, 2026
- CVE-2026-48234 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated iHigh 7.1 · May 21, 2026
- CVE-2026-48233 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT cHigh 7.1 · May 21, 2026
- CVE-2026-48232 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMHigh 7.1 · May 21, 2026
- CVE-2026-48231 Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concaHigh 7.1 · May 21, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.