Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

460 results · page 5 of 10

Sep 27, 2023Local privilege escalation due to insecure folder permissions.CVE-2023-44157 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 27, 2023Sensitive information disclosure due to spell-jacking.CVE-2023-44156 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 27, 2023Sensitive information leak through log files.CVE-2023-44155 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 27, 2023Sensitive information disclosure and manipulation due to improper authorization.CVE-2023-44154 · Other software · Acronis · reported by security@acronis.comHigh 8.1
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 27, 2023Sensitive information disclosure due to cleartext storage of sensitive information in memory.CVE-2023-44153 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 27, 2023Sensitive information disclosure and manipulation due to improper authentication.CVE-2023-44152 · Other software · Acronis · reported by security@acronis.comCritical 9.1
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 21, 2023There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malCVE-2023-43309 · Other software · Webmin · reported by MITREMedium 4.8
There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.
Product
Webmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 20, 2023Sensitive information disclosure due to insecure folder permissions.CVE-2023-5042 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTMLCVE-2023-41154 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable.
Product
Usermin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com webmin.com
Aug 31, 2023Sensitive information leak through log files.CVE-2023-4688 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Sensitive information disclosure due to improper token expiration validation.CVE-2023-41751 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Sensitive information disclosure due to missing authorization.CVE-2023-41750 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Sensitive information disclosure due to excessive collection of system information.CVE-2023-41749 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Local privilege escalation during installation due to improper soft link handling.CVE-2022-46869 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Remote command execution due to improper input validation.CVE-2023-41748 · Other software · Acronis · reported by security@acronis.comCritical 9.8
Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Product
Acronis Cloud Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Sensitive information disclosure due to unauthenticated path traversal.CVE-2023-41747 · Other software · Acronis · reported by security@acronis.comMedium 6.5
Sensitive information disclosure due to unauthenticated path traversal. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Product
Acronis Cloud Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Remote command execution due to improper input validation.CVE-2023-41746 · Other software · Acronis · reported by security@acronis.comCritical 9.8
Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
Product
Acronis Cloud Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Sensitive information disclosure due to excessive collection of system information.CVE-2023-41745 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2023-41744 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Local privilege escalation due to insecure driver communication port permissions.CVE-2023-41743 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber Protect 15 (Windows) before build 35979, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Excessive attack surface due to binding to an unrestricted IP address.CVE-2023-41742 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Local privilege escalation during recovery due to improper soft link handling.CVE-2022-46868 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 31, 2023Local privilege escalation due to insecure driver communication port permissions.CVE-2022-45451 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Aug 16, 2023A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.CVE-2023-38894 · Other software · Tree KIT Project · reported by MITRECritical 9.8
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
Product
Tree KIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com code-intelligence.com
Aug 9, 2023A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allowCVE-2023-39008 · Other software · Opnsense · reported by MITRECritical 9.8
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com logicaltrust.net
Aug 9, 2023/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controlleCVE-2023-39007 · Other software · Opnsense · reported by MITRECritical 9.6
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 18, 2023Sensitive information disclosure due to improper authorization.CVE-2023-2782 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
Product
Acronis Cyber Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2022-4418 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Sensitive information disclosure due to insecure registry permissions.CVE-2022-45459 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Sensitive information disclosure and manipulation due to improper certification validation.CVE-2022-45458 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 29633, Acronis Cyber Protect 15 (Windows, macOS, Linux) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Sensitive information disclosure and manipulation due to improper certification validation.CVE-2022-45457 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before build 29633, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023TLS/SSL weak cipher suites enabled.CVE-2022-45453 · Other software · Acronis · reported by security@acronis.comHigh 7.5
TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Local privilege escalation due to insecure folder permissions.CVE-2022-45452 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 18, 2023Sensitive information disclosure and manipulation due to improper authorization.CVE-2022-45450 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
May 3, 2023Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent.CVE-2022-3405 · Other software · Acronis · reported by security@acronis.comHigh 8.8
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record herolab.usd.de security-advisory.acronis.com
May 3, 2023Sensitive information disclosure due to improper authentication.CVE-2022-30995 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
Product
Acronis Cyber Protect 15
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 28, 2023Sensitive information disclosure due to CORS misconfiguration.CVE-2023-2360 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
Product
Acronis Cyber Infrastructure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 27, 2023Local privilege escalation due to a DLL hijacking vulnerability.CVE-2023-2355 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900.
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 26, 2023Denial of service due to unauthenticated API endpoint.CVE-2022-45456 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 24, 2023SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontControllCVE-2023-26865 · Other software · Brandsdistribution · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component.
Product
Bdroppy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bdroppy.com friends-of-presta.github.io
Mar 23, 2023Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.CVE-2023-28611 · Other software · Omicronenergy · reported by MITRECritical 9.8
Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.
Product
Stationguard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record omicronenergy.com omicronenergy.com
Mar 23, 2023The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image.CVE-2023-28610 · Other software · Omicronenergy · reported by MITRECritical 9.8
The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update image. This allows a remote attacker to gain root access to the system.
Product
Stationguard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record omicronenergy.com omicronenergy.com
Mar 22, 2023XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cronCVE-2022-30037 · Other software · Xunruicms · reported by MITREHigh 7.2
XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cron.php.
Product
Xunruicms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record weltolk.github.io weltolk.github.io
Feb 13, 2023Local privilege escalation due to incomplete uninstallation cleanup.CVE-2022-45455 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Cyber Protect Home Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 13, 2023Sensitive information disclosure due to insecure folder permissions.CVE-2022-45454 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis Cyber Protect 15 (Windows) before build 30984.
Product
Acronis Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Jan 27, 2023Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.CVE-2022-48118 · Other software · Jorani · reported by MITREMedium 6.1
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
Product
Jorani
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 7, 2023A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7.CVE-2021-4306 · Other software · cronvel · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217620.
Product
terminal-kit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org github.com
Jan 2, 2023A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7.CVE-2021-4299 · Other software · cronvel · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 is able to address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.
Product
string-kit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 25, 2022A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x.CVE-2021-4278 · Other software · cronvel · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
Product
tree-kit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.