Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 22 of 61
Sep 3, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.CVE-2023-4751 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 2, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.CVE-2023-4738 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 2, 2023Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.CVE-2023-4736 · Other software · vim · reported by security@huntr.devHigh 7.8
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 2, 2023Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.CVE-2023-4735 · Other software · vim · reported by security@huntr.devHigh 7.8
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 2, 2023Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.CVE-2023-4734 · Other software · vim · reported by security@huntr.devHigh 7.8
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Sep 1, 2023Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4722 · Other software · gpac · reported by security@huntr.devMedium 5.5
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4721 · Other software · gpac · reported by security@huntr.devMedium 5.5
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4720 · Other software · gpac · reported by security@huntr.devMedium 5.5
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstrCVE-2023-23763 · Other software · GitHub · reported by product-cna@github.comMedium 5.3
An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.10.0 and was fixed in versions 3.9.4, 3.8.9, 3.7.16 and 3.6.18. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Sep 1, 2023External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4704 · Other software · instantsoft · reported by security@huntr.devMedium 4.9
External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4698 · Other software · usememos · reported by security@huntr.devHigh 7.5
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4697 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4696 · Other software · usememos · reported by security@huntr.devCritical 9.8
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-4695 · Other software · pkp · reported by security@huntr.devHigh 8.1
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4683 · Other software · gpac · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4682 · Other software · gpac · reported by security@huntr.devMedium 5.5
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4681 · Other software · gpac · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-4678 · Other software · gpac · reported by security@huntr.devMedium 5.5
Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4655 · Other software · instantsoft · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4654 · Other software · instantsoft · reported by security@huntr.devLow 3.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4653 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4652 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4651 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4650 · Other software · instantsoft · reported by security@huntr.devMedium 4.7
Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4649 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened PuCVE-2023-23765 · Other software · GitHub · reported by product-cna@github.comMedium 4.8
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To exploit this vulnerability, an attacker would need write access to the repository. This vulnerability was reported via the GitHub Bug Bounty Program https://bounty.github.com/ .
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-4624 · Other software · bookstackapp · reported by security@huntr.devLow 2.4
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.CVE-2023-4561 · Other software · omeka · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4.
- Product
- omeka/omeka-s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2023Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.CVE-2023-4560 · Other software · omeka · reported by security@huntr.devMedium 6.5
Improper Authorization of Index Containing Sensitive Information in GitHub repository omeka/omeka-s prior to 4.0.4.
- Product
- omeka/omeka-s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-4455 · Other software · wallabag · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-4454 · Other software · wallabag · reported by security@huntr.devMedium 5.7
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.CVE-2023-4453 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-4451 · Other software · cockpit-hq · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2023Improper Input Validation in GitHub repository hamza417/inure prior to build88.CVE-2023-4435 · Other software · hamza417 · reported by security@huntr.devMedium 5.5
Improper Input Validation in GitHub repository hamza417/inure prior to build88.
- Product
- hamza417/inure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2023Missing Authorization in GitHub repository hamza417/inure prior to build88.CVE-2023-4434 · Other software · hamza417 · reported by security@huntr.devMedium 6.1
Missing Authorization in GitHub repository hamza417/inure prior to build88.
- Product
- hamza417/inure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-4433 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-4432 · Other software · cockpit-hq · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.CVE-2023-4422 · Other software · cockpit-hq · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-4395 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4381 · Other software · instantsoft · reported by security@huntr.devMedium 4.3
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.CVE-2023-4347 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place.CVE-2023-40013 · Other software · shubhamjain · reported by GitHubHigh 7.1
SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in Cross-site Scripting (XSS). When trying to sanitize the svg the lib removes event attributes such as `onmouseover`, `onclick` but the list of events is not exhaustive. Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack. This issue has been addressed in commit `d3562fc08` which is included in releases from 1.6.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- svg-loader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.CVE-2023-4322 · Other software · radareorg · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.CVE-2023-4321 · Other software · cockpit-hq · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2023Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_pCVE-2023-4265 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 6.4
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 11, 2023Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackerCVE-2020-19952 · Other software · JBT · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.
- Product
- Live (github-flavored) Markdown Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Improper access control in the Intel(R) Unite(R) Hub software installer for Windows before version 4.2.34962 may allow an authenticated user to potentially enabCVE-2023-25773 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper access control in the Intel(R) Unite(R) Hub software installer for Windows before version 4.2.34962 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Unite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.CVE-2023-4304 · Other software · froxlor · reported by security@huntr.devLow 3.8
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.CVE-2023-4196 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.CVE-2023-4195 · Other software · cockpit-hq · reported by security@huntr.devHigh 8.8
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.