Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
35added in the last 30 days
575new WordPress flaws this week
391,358entries in the database

3,050 results · page 35 of 61

  • Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4807 · Other software · usememos · reported by security@huntr.devMedium 4.3

    Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4806 · Other software · usememos · reported by security@huntr.devMedium 5.3

    Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4805 · Other software · usememos · reported by security@huntr.devMedium 4.3

    Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4804 · Other software · usememos · reported by security@huntr.devMedium 5.3

    Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4803 · Other software · usememos · reported by security@huntr.devHigh 8.8

    Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4802 · Other software · usememos · reported by security@huntr.devMedium 5.4

    Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4801 · Other software · usememos · reported by security@huntr.devMedium 5.3

    Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4800 · Other software · usememos · reported by security@huntr.devMedium 6.5

    Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4799 · Other software · usememos · reported by security@huntr.devMedium 6.5

    Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4798 · Other software · usememos · reported by security@huntr.devMedium 5.3

    Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4797 · Other software · usememos · reported by security@huntr.devMedium 4.3

    Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 28, 2022Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4796 · Other software · usememos · reported by security@huntr.devHigh 8.1

    Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022DNSSEC validation is not performed correctly.CVE-2022-3347 · Other software · github.com/peterzen/goresolver · reported by security@golang.orgHigh 7.5

    DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.

    Product
    github.com/peterzen/goresolver
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022DNSSEC validation is not performed correctly.CVE-2022-3346 · Other software · github.com/peterzen/goresolver · reported by security@golang.orgMedium 6.5

    DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.

    Product
    github.com/peterzen/goresolver
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending oCVE-2020-36563 · Other software · github.com/RobotsAndPencils/go-saml · reported by security@golang.orgMedium 5.3

    XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.

    Product
    github.com/RobotsAndPencils/go-saml
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.CVE-2020-36562 · Other software · github.com/shiyanhui/dht · reported by security@golang.orgHigh 7.5

    Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.

    Product
    github.com/shiyanhui/dht
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022The dag-pb codec can panic when decoding invalid blocks.CVE-2022-2584 · Other software · github.com/ipld/go-codec-dagpb · reported by security@golang.orgHigh 7.5

    The dag-pb codec can panic when decoding invalid blocks.

    Product
    github.com/ipld/go-codec-dagpb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022A race condition can cause incorrect HTTP request routing.CVE-2022-2583 · Other software · github.com/ntbosscher/gobase · reported by security@golang.orgLow 3.7

    A race condition can cause incorrect HTTP request routing.

    Product
    github.com/ntbosscher/gobase/auth/httpauth
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field.CVE-2022-2582 · Other software · github.com/aws/aws-sdk-go · reported by security@golang.orgMedium 4.3

    The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.

    Product
    github.com/aws/aws-sdk-go/service/s3/s3crypto
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack.CVE-2021-4239 · Other software · github.com/flynn/noise · reported by security@golang.orgHigh 7.5

    The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.

    Product
    github.com/flynn/noise
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Randomly-generated alphanumeric strings contain significantly less entropy than expected.CVE-2021-4238 · Other software · github.com/Masterminds/goutils · reported by security@golang.orgCritical 9.1

    Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.

    Product
    github.com/Masterminds/goutils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to CVE-2021-4236 · Other software · github.com/ecnepsnai/web · reported by security@golang.orgCritical 9.8

    Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

    Product
    github.com/ecnepsnai/web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 iCVE-2020-36569 · Other software · github.com/nanobox-io/golang-nanoauth · reported by security@golang.orgCritical 9.1

    Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

    Product
    github.com/nanobox-io/golang-nanoauth
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.CVE-2020-36568 · Other software · github.com/revel/revel · reported by security@golang.orgHigh 7.5

    Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.

    Product
    github.com/revel/revel
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36566 · Other software · github.com/whyrusleeping/tar-utils · reported by security@golang.orgCritical 9.1

    Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

    Product
    github.com/whyrusleeping/tar-utils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be cCVE-2020-36564 · Other software · github.com/justinas/nosurf · reported by security@golang.orgHigh 7.5

    Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.

    Product
    github.com/justinas/nosurf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36561 · Other software · github.com/yi-ge/unzip · reported by security@golang.orgCritical 9.1

    Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

    Product
    github.com/yi-ge/unzip
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36560 · Other software · github.com/artdarek/go-unzip · reported by security@golang.orgCritical 9.1

    Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

    Product
    github.com/artdarek/go-unzip
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.CVE-2019-25073 · Other software · github.com/goadesign/goa · reported by security@golang.orgHigh 7.5

    Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory.

    Product
    github.com/goadesign/goa
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a signCVE-2019-25072 · Other software · github.com/tendermint/tendermint · reported by security@golang.orgHigh 7.5

    Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.

    Product
    github.com/tendermint/tendermint/rpc/lib/client
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, whiCVE-2017-20146 · Other software · github.com/gorilla/handlers · reported by security@golang.orgCritical 9.8

    Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

    Product
    github.com/gorilla/handlers
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSCVE-2016-15005 · Other software · github.com/dinever/golf · reported by security@golang.orgHigh 8.8

    CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.

    Product
    github.com/dinever/golf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Token validation methods are susceptible to a timing side-channel during HMAC comparison.CVE-2015-10004 · Other software · github.com/robbert229/jwt · reported by security@golang.orgHigh 7.5

    Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.

    Product
    github.com/robbert229/jwt
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.CVE-2014-125026 · Other software · github.com/cloudflare/golz4 · reported by security@golang.orgCritical 9.8

    LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

    Product
    github.com/cloudflare/golz4
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overfCVE-2013-10005 · Other software · github.com/btcsuite/go-socks · reported by security@golang.orgHigh 7.5

    The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.

    Product
    github.com/btcsuite/go-socks
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-36567 · Other software · github.com/gin-gonic/gin · reported by security@golang.orgHigh 7.5

    Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

    Product
    github.com/gin-gonic/gin
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Denial of Service in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4767 · Other software · usememos · reported by security@huntr.devHigh 7.5

    Denial of Service in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4734 · Other software · usememos · reported by security@huntr.devHigh 8.1

    Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4733 · Other software · openemr · reported by security@huntr.devMedium 4.8

    Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.

    Product
    openemr/openemr
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-4732 · Other software · microweber · reported by security@huntr.devHigh 7.2

    Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.

    Product
    microweber/microweber
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4724 · Other software · ikus060 · reported by security@huntr.devCritical 9.8

    Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4723 · Other software · ikus060 · reported by security@huntr.devMedium 6.5

    Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4722 · Other software · ikus060 · reported by security@huntr.devHigh 7.2

    Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4721 · Other software · ikus060 · reported by security@huntr.devMedium 5.4

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4720 · Other software · ikus060 · reported by security@huntr.devMedium 6.1

    Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4719 · Other software · ikus060 · reported by security@huntr.devCritical 9.8

    Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.

    Product
    ikus060/rdiffweb
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4695 · Other software · usememos · reported by security@huntr.devMedium 5.4

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4694 · Other software · usememos · reported by security@huntr.devMedium 5.4

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4691 · Other software · usememos · reported by security@huntr.devMedium 5.4

    Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

    Product
    usememos/memos
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 25, 2022A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x.CVE-2019-25084 · Other software · Hide Files ON Github Project · reported by VulDBLow 3.5

    A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the file extension/options.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 9de0c57df81db1178e0e79431d462f6d9842742e. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216767.

    Product
    Hide Files ON Github
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.