Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
314 results · page 2 of 7
Jun 9, 2026Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.CVE-2026-41843 · Other software · Spring · reported by security@vmware.comMedium 5.9
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.CVE-2026-41842 · Other software · Spring · reported by security@vmware.comHigh 7.5
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.CVE-2026-41841 · Other software · Spring · reported by security@vmware.comMedium 5.9
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.CVE-2026-41840 · Other software · Spring · reported by security@vmware.comMedium 5.9
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a CVE-2026-41839 · Other software · Spring · reported by security@vmware.comMedium 4.2
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.CVE-2026-44600 · Other software · torproject · reported by MITRELow 3.7
Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.
- Product
- Tor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.torproject.orggitlab.torproject.org
May 6, 2026Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.CVE-2026-44599 · Other software · torproject · reported by MITRELow 3.7
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Product
- Tor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.torproject.orggitlab.torproject.org
May 1, 2026A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0.CVE-2026-7594 · Other software · Flux159 · reported by VulDBMedium 5.5
A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0. Affected is the function image_to_3d_async of the file src/index.ts of the component MCP Interface. The manipulation of the argument statusFile results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mcp-game-asset-gen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.CVE-2026-22745 · Other software · VMware · reported by security@vmware.comMedium 5.3
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is serving static resources from the file system * the application is running on a Windows platform When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.CVE-2026-22741 · Other software · VMware · reported by security@vmware.comLow 3.1
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.CVE-2026-22740 · Other software · VMware · reported by security@vmware.comMedium 6.5
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.CVE-2026-39884 · Other software · Flux159 · reported by GitHubHigh 8.3
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers.CVE-2026-40109 · Other software · fluxcd · reported by GitHubLow 3.1
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations. Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as /hook/sha256sum(token+name+namespace), where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's .status.webhookPath in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config). Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured
- Product
- notification-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026LuxeDrive: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27076 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allows PHP Local File Inclusion.This issue affects LuxeDrive: from n/a through <= 1.0.
- Product
- LuxeDrive
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LuxeDrive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Dentalux: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22508 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Dentalux dentalux allows PHP Local File Inclusion.This issue affects Dentalux: from n/a through <= 3.3.
- Product
- Dentalux
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Dentalux to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE).CVE-2026-22735 · Other software · Spring · reported by security@vmware.comLow 2.6
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
- Product
- Spring Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automaticallCVE-2025-70129 · Other software · Pluxml · reported by MITREMedium 5.3
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier.CVE-2025-70128 · Other software · Pluxml · reported by MITREMedium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Luxury Wine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28016 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Luxury Wine luxury-wine allows PHP Local File Inclusion.This issue affects Luxury Wine: from n/a through <= 1.1.14.
- Product
- Luxury Wine
- Affected
- up to 1.1.14
- What to do
- Affects up to 1.1.14. Update Luxury Wine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2026PluXml CMS allows a user's session identifier to be set before authentication.CVE-2026-24352 · Other software · PluXml · reported by cvd@cert.plMedium 4.8
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality.CVE-2026-24351 · Other software · PluXml · reported by cvd@cert.plMedium 5.1
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PluXml CMS is vulnerable to Stored XSS in file uploading functionality.CVE-2026-24350 · Other software · PluXml · reported by cvd@cert.plMedium 5.1
PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-rc7 clicking the link associated with the uploaded image doesn't execute malicious code but directly accessing the file will still execute the embedded payload. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution.CVE-2026-23990 · Other software · controlplaneio-fluxcd · reported by GitHubMedium 5.3
The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. In order to be vulnerable, cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., `email`, `groups`), or configure custom CEL expressions that can evaluate to empty values. After OIDC token claims are processed through CEL expressions, there is no validation that the resulting `username` and `groups` values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions. This can result in privilege escalation, data exposure, and/or information disclosure. Version 0.40.0 patches the issue.
- Product
- flux-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026A vulnerability was found in Luxul XWR-600 up to 4.0.1.CVE-2025-15505 · Other software · Luxul · reported by VulDBLow 1.9
A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond with a technical statement.
- Product
- XWR-600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Jan 8, 2026Miniflux 2 is an open source feed reader.CVE-2026-21885 · Other software · miniflux · reported by GitHubMedium 6.5
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
- Product
- v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026A vulnerability was determined in PluXml up to 5.8.22.CVE-2025-15438 · Other software · Pluxml · reported by VulDBLow 2
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 22, 2025Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a themCVE-2025-67436 · Other software · Pluxml · reported by MITREMedium 6.5
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc.CVE-2025-13474 · Other software · Menulux Software Inc. · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8.
- Product
- Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 10, 2025Miniflux 2 is an open source feed reader.CVE-2025-67713 · Other software · miniflux · reported by GitHubMedium 5.3
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
- Product
- v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery.CVE-2025-11022 · Other software · Personal Project · reported by iletisim@usom.gov.trCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.
- Product
- Panilux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 3, 2025MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it.CVE-2025-66404 · Other software · Flux159 · reported by GitHubMedium 6.4
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.CVE-2025-63453 · Other software · Car-booking-system-php Project · reported by MITRECritical 9.8
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.
- Product
- Car-booking-system-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.CVE-2025-63452 · Other software · Car-booking-system-php Project · reported by MITRECritical 9.4
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.
- Product
- Car-booking-system-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.CVE-2025-63451 · Other software · Car-booking-system-php Project · reported by MITRECritical 9.8
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.
- Product
- Car-booking-system-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.CVE-2025-63450 · Other software · Car-booking-system-php Project · reported by MITREMedium 5.4
Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.
- Product
- Car-booking-system-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Oct 29, 2025FluxCP is a web-based Control Panel for rAthena servers written in PHP.CVE-2025-62797 · Other software · rathena · reported by GitHubHigh 8.6
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.
- Product
- FluxCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025PT Luxa Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60217 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This issue affects PT Luxa Addons: from n/a through <= 1.2.2.
- Product
- PT Luxa Addons
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update PT Luxa Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2025A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directoryCVE-2025-57567 · Other software · reported by MITRECritical 9.1
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackerCVE-2025-41253 · Other software · VMware · reported by security@vmware.comHigh 7.5
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
- Product
- Spring Cloud Gateway Server Webflux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.CVE-2025-41243 · Other software · Spring · reported by security@vmware.comCritical 10
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
- Product
- Cloud Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida.CVE-2025-55751 · Other software · HackUCF · reported by GitHubMedium 5.1
OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements jwt signing for the redirect url parameter.
- Product
- OnboardLite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7222 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26473.
- Product
- KeyShot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyshot.comzerodayinitiative.com
Jul 21, 2025A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' CVE-2020-26799 · Other software · reported by MITRECritical 9.8
A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuryadina.comluxsoft.eu
Jul 8, 2025MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it.CVE-2025-53355 · Other software · Flux159 · reported by GitHubHigh 7.5
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.
- Product
- mcp-server-kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025fluXtore: Missing AuthorizationCVE-2025-30929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.
- Product
- fluXtore
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update fluXtore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.CVE-2025-44110 · Other software · Fluxbb · reported by MITREMedium 5.4
FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.
- Product
- Fluxbb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025BBCode Deluxe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46479 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Based XSS.This issue affects BBCode Deluxe: from n/a through <= 2020.08.01.2.
- Product
- BBCode Deluxe
- Affected
- up to 2020.08.01.2
- What to do
- Affects up to 2020.08.01.2. Update BBCode Deluxe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2025Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability.CVE-2025-1047 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pvs files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23694.
- Product
- KeyShot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.keyshot.comzerodayinitiative.com
Apr 23, 2025Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2025-1046 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23646.
- Product
- KeyShot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.keyshot.comzerodayinitiative.com
Apr 23, 2025Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2025-1045 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24586.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.keyshot.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.