Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 25 of 61
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3083 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.7
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.CVE-2023-3073 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3075 · Other software · tsolucio · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3074 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3071 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3070 · Other software · tsolucio · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.CVE-2023-3069 · Other software · tsolucio · reported by security@huntr.devCritical 9.8
Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
- Product
- tsolucio/corebos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.CVE-2023-3067 · Other software · zadam · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
- Product
- zadam/trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.CVE-2023-3026 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.CVE-2023-3021 · Other software · mkucej · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
- Product
- mkucej/i-librarian-free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.CVE-2023-3020 · Other software · mkucej · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
- Product
- mkucej/i-librarian-free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-3013 · Other software · gpac · reported by security@huntr.devHigh 7.1
Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-3012 · Other software · gpac · reported by security@huntr.devHigh 7.8
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3009 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site ScriCVE-2023-26131 · Other software · Algernon Project · reported by report@snyk.ioMedium 5.4
All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found.
- Product
- Algernon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.CVE-2023-2999 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.CVE-2023-2998 · Other software · thorsten · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023CKAN is an open-source data management system for powering data hubs and data portals.CVE-2023-32696 · Other software · ckan · reported by GitHubHigh 8.8
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.
- Product
- ckan-docker-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.CVE-2023-2984 · Other software · pimcore · reported by security@huntr.devHigh 8.8
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.CVE-2023-2983 · Other software · pimcore · reported by security@huntr.devHigh 8.8
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.CVE-2023-2972 · Other software · antfu · reported by security@huntr.devCritical 9.8
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
- Product
- antfu/utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2023Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.CVE-2023-2954 · Other software · liangliangyy · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.
- Product
- liangliangyy/djangoblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2950 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2949 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2948 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2947 · Other software · openemr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2946 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2945 · Other software · openemr · reported by security@huntr.devMedium 5.4
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2944 · Other software · openemr · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Code Injection in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2943 · Other software · openemr · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2942 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023CKAN is an open-source data management system for powering data hubs and data portals.CVE-2023-32321 · Other software · ckan · reported by GitHubCritical 9.8
CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have b
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-2881 · Other software · pimcore · reported by security@huntr.devMedium 4.9
Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0.CVE-2023-2872 · Other software · Electronic · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229851. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flexihub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 24, 2023Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-2859 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-2845 · Other software · cloudexplorer-dev · reported by security@huntr.devHigh 8.1
Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
- Product
- cloudexplorer-dev/cloudexplorer-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-2844 · Other software · cloudexplorer-dev · reported by security@huntr.devMedium 4.9
Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
- Product
- cloudexplorer-dev/cloudexplorer-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it.CVE-2023-28649 · Other software · Snap One · reported by ics-cert@hq.dhs.govHigh 8.6
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
- Product
- OvrC Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.CVE-2023-31584 · Other software · Silicon Project · reported by MITREMedium 6.1
GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.
- Product
- Silicon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-2840 · Other software · gpac · reported by security@huntr.devCritical 9.8
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-2839 · Other software · gpac · reported by security@huntr.devHigh 7.5
Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-2838 · Other software · gpac · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-2837 · Other software · gpac · reported by security@huntr.devMedium 5.5
Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses OpenCVE-2023-32348 · Other software · Teltonika · reported by ics-cert@hq.dhs.govMedium 5.8
Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network (VPN) hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The OpenVPN server also allows users to route through it. An attacker could route a connection to a remote server through the OpenVPN server, enabling them to scan and access data from other Teltonika devices connected to the VPN.
- Product
- Remote Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023 SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.CVE-2023-2832 · Other software · unilogies · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.CVE-2023-2800 · Other software · huggingface · reported by security@huntr.devMedium 4.7
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
- Product
- huggingface/transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.CVE-2023-2780 · Other software · mlflow · reported by security@huntr.devCritical 9.8
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).CVE-2023-31722 · Other software · Nasm · reported by MITREHigh 7.8
There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
May 17, 2023SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-2756 · Other software · pimcore · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-2753 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.