Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391 results · page 3 of 8
May 20, 2026NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domaiCVE-2026-40622 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.6
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
- Product
- Hide My WP Ghost
- What to do
- Update Hide My WP Ghost to the newest version.
Mar 10, 2026Ghostty is a cross-platform terminal emulator.CVE-2026-26982 · Other software · ghostty-org · reported by GitHubMedium 6.3
Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.
- Product
- ghostty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Ghost is a Node.js content management system.CVE-2026-29784 · Other software · TryGhost · reported by GitHubHigh 7.5
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. This issue has been patched in version 6.19.3.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Ghostfolio is an open source wealth management software.CVE-2026-28785 · Other software · ghostfolio · reported by GitHubCritical 9.3
Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL commands via the getHistorical() method, potentially allowing them to read, modify, or delete sensitive financial data for all users in the database. This issue has been patched in version 2.244.0.
- Product
- ghostfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Ghostfolio is an open source wealth management software.CVE-2026-28680 · Other software · ghostfolio · reported by GitHubCritical 9.3
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
- Product
- ghostfolio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Ghost is a Node.js content management system.CVE-2026-29053 · Other software · TryGhost · reported by GitHubHigh 7.6
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the headCVE-2026-26365 · Other software · Akamai · reported by MITREMedium 4
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Ghost is a Node.js content management system.CVE-2026-26980 · Other software · TryGhost · reported by GitHubCritical 9.4
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Ghost is an open source content management system.CVE-2026-24778 · Other software · TryGhost · reported by GitHubHigh 8.8
Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP CVE-2021-47752 · Other software · Sylkat-Tools · reported by VulnCheckHigh 8.7
AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP requests. Attackers can generate high-volume requests to multiple endpoints including /mysqladmin to potentially crash or render the service unresponsive.
- Product
- AWebServer GhostBuilding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsylkat-tools.rf.gdplay.google.com
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22597 · Other software · TryGhost · reported by GitHubMedium 5.1
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22596 · Other software · TryGhost · reported by GitHubMedium 6.7
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22595 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22594 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling.CVE-2025-66373 · Other software · Akamai · reported by MITREMedium 4.8
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
- Product
- Akamaighost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orgakamai.com
Oct 27, 2025A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014.CVE-2025-12342 · Other software · Serdar Bayram · reported by VulDBMedium 5.5
A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ghost Hot Spot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.mevuldb.com
Oct 22, 2025Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK.CVE-2025-41110 · Other software · Ghost Robotics · reported by cve-coordination@incibe.esHigh 7
Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
- Product
- Vision 60
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port.CVE-2025-41109 · Other software · Ghost Robotics · reported by cve-coordination@incibe.esHigh 8.7
Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.
- Product
- Vision 60
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack stationCVE-2025-41108 · Other software · Ghost Robotics · reported by cve-coordination@incibe.esCritical 9.2
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the robot from any attacking computer or device. The communication protocol used in this interface is based on MAVLink, a widely documented protocol, which increases the likelihood of attack. There are two methods for connecting to the robot remotely: Wi-Fi and 4G/LTE.
- Product
- Vision 60
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.CVE-2025-60834 · Other software · Ghostxbh · reported by MITREMedium 6.5
A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.
- Product
- Uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 8, 2025An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafCVE-2025-60833 · Other software · Ghostxbh · reported by MITREMedium 6.5
An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data.
- Product
- Uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2025In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.CVE-2025-59801 · Other software · Artifex · reported by MITREMedium 4.3
In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.
- Product
- GhostXPS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
Sep 22, 2025In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.CVE-2025-59800 · Other software · Artifex · reported by MITREMedium 4.3
In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
Sep 22, 2025Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.CVE-2025-59799 · Other software · Artifex · reported by MITREMedium 4.3
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
Sep 22, 2025Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.CVE-2025-59798 · Other software · Artifex · reported by MITREMedium 4.3
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
Sep 18, 2025Ghost Kit – Page Builder Blocks, Motion Effects & Extensions: Stored Cross-Site ScriptingCVE-2025-9992 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ghost Kit – Page Builder Blocks, Motion Effects & Extensions
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Ghost Kit – Page Builder Blocks, Motion Effects & Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2025Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, frCVE-2025-9862 · Other software · Ghost · reported by help@fluidattacks.comMedium 6.1
Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Aug 28, 2025Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within thCVE-2025-54142 · Other software · Akamai · reported by MITREMedium 4
Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards.
- Product
- AkamaiGhost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.akamai.comakamai.com
Aug 20, 2025Ghost Kit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53567 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through <= 3.4.1.
- Product
- Ghost Kit
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Ghost Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2025An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26.CVE-2025-32094 · Other software · Akamai · reported by MITREMedium 4
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
- Product
- AkamaiGhost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orgakamai.com
Aug 4, 2025CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks.CVE-2025-51726 · Other software · reported by MITREHigh 8.4
CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicious actor to craft a fake installer with a forged SHA-1 certificate that may still be accepted by Windows signature verification mechanisms, particularly on systems without strict SmartScreen or trust policy enforcement. Additionally, the installer lacks High Entropy Address Space Layout Randomization (ASLR), as confirmed by BinSkim (BA2015 rule) and repeated WinDbg analysis. The binary consistently loads into predictable memory ranges, increasing the success rate of memory corruption exploits. These two misconfigurations, when combined, significantly lower the bar for successful supply-chain style attacks or privilege escalation through fake installers.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145.CVE-2025-7462 · Other software · Artifex · reported by VulDBMedium 5.3
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
- Product
- GhostPDL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartifex.comcgit.ghostscript.com
May 23, 2025gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case.CVE-2025-48708 · Other software · Artifex · reported by MITREMedium 4
gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
May 19, 2025Ghostwriter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23988 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4.
- Product
- Ghostwriter
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Ghostwriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2025In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding.CVE-2025-46646 · Other software · Artifex · reported by MITREMedium 4.5
In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comcgit.ghostscript.com
Apr 14, 2025A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0.CVE-2025-3561 · Other software · ghostxbh · reported by VulDBMedium 5.3
A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic.CVE-2025-3560 · Other software · ghostxbh · reported by VulDBMedium 5.1
A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The manipulation of the argument product_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical.CVE-2025-3559 · Other software · ghostxbh · reported by VulDBMedium 5.3
A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0.CVE-2025-3558 · Other software · ghostxbh · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025Hide My WP Ghost: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26909 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows PHP Local File Inclusion.This issue affects Hide My WP Ghost: from n/a through <= 5.4.01.
- Product
- Hide My WP Ghost
- Affected
- up to 5.4.01
- What to do
- Affects up to 5.4.01. Update Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27837 · Other software · Artifex · reported by MITRECritical 9.8
An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27836 · Other software · Artifex · reported by MITRECritical 9.8
An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comlists.debian.org
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27835 · Other software · Artifex · reported by MITREHigh 7.8
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comlists.debian.org
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27834 · Other software · Artifex · reported by MITREHigh 7.8
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27833 · Other software · Artifex · reported by MITREHigh 7.8
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27832 · Other software · Artifex · reported by MITRECritical 9.8
An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comlists.debian.org
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27831 · Other software · Artifex · reported by MITRECritical 9.8
An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comlists.debian.org
Mar 25, 2025An issue was discovered in Artifex Ghostscript before 10.05.0.CVE-2025-27830 · Other software · Artifex · reported by MITREHigh 7.8
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.
- Product
- Ghostscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ghostscript.comlists.debian.org
Mar 14, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Path TraversalCVE-2025-2056 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.
- Product
- WP Ghost (Hide My WP Ghost) – Security & Firewall
- Affected
- up to 5.4.01
- What to do
- Affects up to 5.4.01. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.