Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 39 of 61
Sep 15, 2022Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.CVE-2022-3222 · Other software · gpac · reported by security@huntr.devMedium 5.5
Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.CVE-2022-3221 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.CVE-2022-2900 · Other software · ionicabizau · reported by security@huntr.devCritical 9.1
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
- Product
- ionicabizau/parse-url
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3179 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3175 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3174 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.CVE-2022-3178 · Other software · gpac · reported by security@huntr.devHigh 7.8
Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2022This affects the package github.com/gophish/gophish before 0.12.0.CVE-2022-25295 · Other software · Getgophish · reported by report@snyk.ioMedium 5.4
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Sep 9, 2022An issue was discovered in Active Intelligent Visualization 5.CVE-2021-44835 · Other software · Aivhub · reported by MITRECritical 9.8
An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanitized. This causes SQL injection.
- Product
- Active Intelligence Visualization
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comaivhub.com
Sep 9, 2022OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3133 · Other software · jgraph · reported by security@huntr.devHigh 7.8
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.CVE-2022-2925 · Other software · appwrite · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
- Product
- appwrite/appwrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.CVE-2022-3167 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.CVE-2022-3153 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3148 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3138 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.CVE-2022-3152 · Websites & servers · phpfusion · reported by security@huntr.devHigh 8.8
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
- Product
- phpfusion/phpfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0389.CVE-2022-3134 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0389.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.CVE-2022-2714 · Other software · francoisjacquet · reported by security@huntr.devCritical 9.8
Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.CVE-2022-2901 · Other software · chatwoot · reported by security@huntr.devHigh 7.1
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.CVE-2022-3127 · Other software · jgraph · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.CVE-2022-3123 · Other software · splitbrain · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.
- Product
- splitbrain/dokuwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0360.CVE-2022-3099 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.CVE-2022-3065 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25371 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 2, 2022Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25370 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 1, 2022Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.CVE-2022-3072 · Other software · francoisjacquet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.
- Product
- francoisjacquet/rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0322.CVE-2022-3037 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.CVE-2022-3035 · Other software · snipe · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.CVE-2022-3017 · Other software · froxlor · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0286.CVE-2022-3016 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0286.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.CVE-2022-2997 · Other software · snipe · reported by security@huntr.devHigh 8
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0260.CVE-2022-2982 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0260.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.CVE-2022-2980 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0246.CVE-2022-2946 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0246.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.CVE-2022-2965 · Other software · notrinos · reported by security@huntr.devMedium 4.3
Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
- Product
- notrinos/notrinoserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.CVE-2022-2796 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2829 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.CVE-2022-2923 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.CVE-2022-2932 · Other software · bustle · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.
- Product
- bustle/mobiledoc-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2890 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-2930 · Other software · octoprint · reported by security@huntr.devHigh 7.8
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-1340 · Other software · yetiforcecompany · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.CVE-2022-2927 · Other software · notrinos · reported by security@huntr.devCritical 9.8
Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
- Product
- notrinos/notrinoserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2022Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.CVE-2022-2885 · Other software · yetiforcecompany · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
- Product
- yetiforcecompany/yetiforcecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2022Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7.CVE-2022-2921 · Other software · notrinos · reported by security@huntr.devHigh 8.8
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.
- Product
- notrinos/notrinoserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.CVE-2022-0542 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Use After Free in GitHub repository vim/vim prior to 9.0.0225.CVE-2022-2889 · Other software · vim · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository vim/vim prior to 9.0.0225.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.CVE-2022-1021 · Other software · chatwoot · reported by security@huntr.devMedium 5.4
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert.CVE-2021-32862 · Other software · jupyter · reported by GitHubHigh 7.5
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
- Product
- nbconvert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.CVE-2022-2874 · Other software · vim · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.