Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

354 results · page 3 of 8

May 23, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-1803 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.
Affected
up to 3.9.12
What to do
Affects up to 3.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-4316 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.16
What to do
Affects up to 3.9.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2024Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: Missing AuthorizationCVE-2024-34377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
Product
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-3244 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedpress_calendar' shortcode in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.14
What to do
Affects up to 3.9.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-3245 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Youtube block in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.14
What to do
Affects up to 3.9.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 22, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-2688 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress document widget in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.12
What to do
Affects up to 3.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 22, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-2468 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress widget 'embedpress_pro_twitch_theme ' attribute in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.12
What to do
Affects up to 3.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-1802 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wistia embed block in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the user supplied url. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-2128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2024Vimeography: Vimeo Video Gallery: PHP Object InjectionCVE-2024-0825 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeography_duplicate_gallery_serialized in the duplicate_gallery function. This makes it possible for authenticated attackers attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Vimeography: Vimeo Video Gallery
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Vimeography: Vimeo Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2024Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks BCVE-2024-25091 · Other software · J's Communications Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.1
Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature). If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment.
Product
RevoWorks SCVX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jscom.jp jvn.jp
Feb 28, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2024-1425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Calendar Widget Link in all versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.8
What to do
Affects up to 3.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2024-1349 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.8
What to do
Affects up to 3.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the optCVE-2024-22667 · Other software · VIM · reported by MITREHigh 7.8
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
Product
VIM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.githubusercontent.com github.com
Jan 3, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2023-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed_oembed_html shortcode in all versions up to 3.9.5 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability.CVE-2023-48706 · Other software · vim · reported by GitHubLow 3.6
Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48237 · Other software · vim · reported by GitHubLow 2.8
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48236 · Other software · vim · reported by GitHubLow 2.8
Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48235 · Other software · vim · reported by GitHubLow 2.8
Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48234 · Other software · vim · reported by GitHubLow 2.8
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48233 · Other software · vim · reported by GitHubLow 2.8
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48232 · Other software · vim · reported by GitHubLow 3.9
Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 16, 2023Vim is an open source command line text editor.CVE-2023-48231 · Other software · vim · reported by GitHubLow 3.9
Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 6, 2023Macvim is a text editor for MacOS.CVE-2023-41036 · Other software · macvim-dev · reported by GitHubHigh 7.8
Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.
Product
macvim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 27, 2023Vim is an improved version of the good old UNIX editor Vi.CVE-2023-46246 · Other software · vim · reported by GitHubMedium 4
Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
Product
vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 11, 2023Use After Free in GitHub repository vim/vim prior to v9.0.2010.CVE-2023-5535 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to v9.0.2010.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Oct 5, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.CVE-2023-5441 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Oct 2, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.CVE-2023-5344 · Other software · vim · reported by security@huntr.devHigh 7.5
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 14, 2023Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.CVE-2023-2848 · Other software · Movim · reported by report@snyk.ioHigh 8
Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation.
Product
Movim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 5, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.CVE-2023-4781 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 4, 2023Use After Free in GitHub repository vim/vim prior to 9.0.1858.CVE-2023-4752 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 4, 2023Use After Free in GitHub repository vim/vim prior to 9.0.1857.CVE-2023-4750 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.1857.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 4, 2023Use After Free in GitHub repository vim/vim prior to 9.0.1840.CVE-2023-4733 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.1840.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 3, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.CVE-2023-4751 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 2, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.CVE-2023-4738 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 2, 2023Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.CVE-2023-4736 · Other software · vim · reported by security@huntr.devHigh 7.8
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 2, 2023Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.CVE-2023-4735 · Other software · vim · reported by security@huntr.devHigh 7.8
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Sep 2, 2023Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.CVE-2023-4734 · Other software · vim · reported by security@huntr.devHigh 7.8
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Aug 11, 2023vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.CVE-2021-3236 · Other software · VIM · reported by MITREMedium 5.5
vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.
Product
VIM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security.netapp.com
Aug 7, 2023Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3CVE-2023-3896 · Other software · OpenCloudOS · reported by security@opencloudos.techHigh 7.8
Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3
Product
OpenCloudOS Stream
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 20, 2023Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.CVE-2020-20703 · Other software · VIM · reported by MITRECritical 9.8
Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.
Product
VIM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 9, 2023Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.CVE-2023-2610 · Other software · vim · reported by security@huntr.devHigh 7.8
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
May 9, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.CVE-2023-2609 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Apr 29, 2023Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.CVE-2023-2426 · Other software · vim · reported by security@huntr.devMedium 5.3
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 11, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.CVE-2023-1355 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 7, 2023NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.CVE-2023-1264 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 4, 2023Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.CVE-2023-1175 · Other software · vim · reported by security@huntr.devMedium 6.6
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 3, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.CVE-2023-1170 · Other software · vim · reported by security@huntr.devMedium 6.6
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Mar 1, 2023Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.CVE-2023-1127 · Other software · vim · reported by security@huntr.devHigh 7.8
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
Product
vim/vim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Vimeo Video Autoplay Automute
Affected
up to 1.0
What to do
Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.