Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,845 results · page 5 of 37
Feb 17, 2026OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter.CVE-2026-22208 · Other software · OpenS100 Project · reported by VulnCheckCritical 9.4
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
- Product
- OpenS100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication.CVE-2026-2250 · Other software · METIS Cyberspace Technology SA · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdHigh 7.5
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.
- Product
- METIS WIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered loCVE-2019-25315 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 9, 2026In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possibleCVE-2026-25847 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
- Product
- PyCharm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A weakness has been identified in heyewei JFinalCMS 5.0.0.CVE-2026-2200 · Other software · heyewei · reported by VulDBLow 1.9
A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- JFinalCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input.CVE-2020-37134 · Other software · UltraVNC Team · reported by VulnCheckMedium 4.6
UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input. Attackers can generate a malformed 256-byte payload and paste it into the VNC Server connection dialog to trigger an application crash.
- Product
- UltraVNC Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comuvnc.com
Feb 5, 2026Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception HandCVE-2020-37120 · Other software · Rubo Medical Imaging · reported by VulnCheckHigh 8.4
Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious text file with carefully constructed payload to execute arbitrary code by overwriting SEH and triggering remote code execution.
- Product
- Rubo DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Feb 5, 2026Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional CVE-2026-23572 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.2
Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional access controls with “Allow after confirmation” configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user needs to be authenticated for the remote session via ID/password, Session Link, or Easy Access as a prerequisite to exploit this vulnerability.
- Product
- Remote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026All In One Image Viewer Block: Server-Side Request ForgeryCVE-2026-1294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- All In One Image Viewer Block
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update All In One Image Viewer Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 2, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue afCVE-2025-6595 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccNone
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.
- Product
- MultimediaViewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
Feb 2, 2026Library Viewer: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2025-15396 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Library Viewer
- Fixed in
- 3.2.0
- What to do
- Update Library Viewer to 3.2.0 or newer.
Feb 1, 2026Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious scriptsCVE-2021-47908 · Other software · thewebfosters · reported by VulnCheckMedium 5.1
Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability through product add or edit functions to execute arbitrary JavaScript and potentially hijack user sessions.
- Product
- Unknown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordultimatefosters.comvulncheck.com
Jan 30, 2026Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using CVE-2025-62349 · Other software · Salt Project · reported by security@vmware.comHigh 7.5
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.saltproject.iodocs.saltproject.io
Jan 29, 2026The Ruijie Networks Switch eWeb S29_RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive conCVE-2020-37015 · Other software · Ruijienetworks · reported by VulnCheckHigh 7.1
The Ruijie Networks Switch eWeb S29_RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve system configuration files containing credentials and network settings.
- Product
- Ruijie Networks Switch eWeb S29_RGOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfaruktuygun.comexploit-db.com
Jan 29, 2026Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font fileCVE-2020-37011 · Other software · GNOME · reported by VulnCheckHigh 8.4
Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file. Attackers can generate a specially crafted TTF file with an oversized pattern to exhaust memory through repeated malloc() calls and potentially crash the gnome-font-viewer process.
- Product
- Fonts Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.gnome.orghelp.gnome.org
Jan 29, 2026A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction.CVE-2026-23571 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.8
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction’s input field. Users of 1E Client version 24.5 or higher are not affected.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 2CVE-2026-23570 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to tamper with log timestamps via crafted UDP Sync command. This could result in forged or nonsensical datetime prefixes and compromising log integrity and forensic correlation.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for WindCVE-2026-23569 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows a remote attacker to leak stack memory and cause a denial of service via a crafted request. The leaked stack memory could be used to bypass ASLR remotely and facilitate exploitation of other vulnerabilities on the affected system.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for WindCVE-2026-23568 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 5.4
An out-of-bounds read vulnerability in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause information disclosure or denial-of-service via a special crafted packet. The leaked memory could be used to bypass ASLR and facilitate further exploitation.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 2CVE-2026-23567 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
An integer underflow in the UDP command handler of the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an adjacent network attacker to trigger a heap-based buffer overflow and cause a denial-of-service (service crash) via specially crafted UDP packets.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker oCVE-2026-23566 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker oCVE-2026-23565 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause the NomadBranch.exe process to terminate via crafted requests. This can result in a denial-of-service condition of the Content Distribution Service.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker oCVE-2026-23564 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause normally encrypted UDP traffic to be sent in cleartext. This can result in disclosure of sensitive information.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 CVE-2026-23563 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 5.7
Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Dozzle is a realtime log viewer for docker containers.CVE-2026-24740 · Other software · amir20 · reported by GitHubHigh 8.7
Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out‑of‑scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.
- Product
- dozzle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Smart Product Viewer: Missing AuthorizationCVE-2026-24588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Product Viewer: from n/a through <= 1.5.4.
- Product
- Smart Product Viewer
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Smart Product Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026ANAC XML Viewer: Server-Side Request Forgery (SSRF)CVE-2025-64252 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a through <= 1.8.2.
- Product
- ANAC XML Viewer
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update ANAC XML Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into theCVE-2025-27379 · Other software · Altium · reported by 4760f414-e1ae-4ff1-bdad-c7a9c3538b79Medium 6.8
A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content.
- Product
- AES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot).CVE-2026-21961 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise HCM Human Resources
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after versionCVE-2025-57156 · Other software · Owntone · reported by MITREHigh 7.5
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allowsCVE-2025-57155 · Other software · Owntone · reported by MITREHigh 7.5
NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service.
- Product
- Owntone Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Clickjacking issue, information disclosure in the PDF Viewer component.CVE-2026-0887 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22789 · Other software · SMEWebify · reported by GitHubMedium 5.4
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry.CVE-2026-22788 · Other software · SMEWebify · reported by GitHubHigh 8.2
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards. This vulnerability is fixed in 1.19.
- Product
- WebErpMesv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-22704 · Other software · haxtheweb · reported by GitHubHigh 8
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026IndieWeb: Stored Cross-Site ScriptingCVE-2025-14893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- IndieWeb
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update IndieWeb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2026Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows aCVE-2026-0747 · Other software · Devolutions · reported by security@devolutions.netLow 3.3
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes libraCVE-2025-14026 · Other software · Forcepoint · reported by cret@cert.orgHigh 7.8
Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.
- Product
- Forcepoint One Endpoint (F1E)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsupport.forcepoint.com
Dec 24, 2025NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings.CVE-2018-25142 · Other software · NovaRad Corporation · reported by VulnCheckHigh 7.1
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.
- Product
- NovaPACS Diagnostics Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnovarad.net
Dec 13, 2025Eyewear prescription form: Missing AuthorizationCVE-2025-14366 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
- Product
- Eyewear prescription form
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Eyewear prescription form: Missing AuthorizationCVE-2025-14365 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce product categories, including all of their child categories, via the 'catIds' parameter.
- Product
- Eyewear prescription form
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025WP3D Model Import Viewer: Arbitrary file uploadsCVE-2025-13094 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_import_file() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP3D Model Import Viewer
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WP3D Model Import Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 11, 2025A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetCVE-2025-64995 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1.CVE-2025-64994 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.5
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate privileges and execute arbitrary code as SYSTEM.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions.CVE-2025-64993 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.8
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25.CVE-2025-64992 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.8
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15.CVE-2025-64991 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.8
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction priorCVE-2025-64990 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 6.8
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruCVE-2025-64989 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.2
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19CVE-2025-64988 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.2
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.