Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

805 results · page 7 of 17

Jan 27, 2024An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments setCVE-2024-23738 · Other software · Postman · reported by MITRECritical 9.8
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."
Product
Postman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com electronjs.org
Jan 19, 2024A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web applicCVE-2023-51948 · Other software · Actidata · reported by MITREHigh 7.5
A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files hosted by the web application.
Product
Actinas SL 2u-8 RDX Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com actidata.com
Jan 19, 2024Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authCVE-2023-51947 · Other software · Actidata · reported by MITRECritical 9.1
Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.
Product
Actinas SL 2u-8 RDX Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com actidata.com
Jan 19, 2024Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary weCVE-2023-51946 · Other software · Actidata · reported by MITREMedium 6.1
Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.
Product
Actinas SL 2u-8 RDX Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com actidata.com
Jan 18, 2024A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nasmCVE-2023-51258 · Other software · tortall · reported by MITREMedium 5.5
A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new_Token function in the modules/preprocs/nasm/nasm-pp:1512.
Product
yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 8, 2024An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments componeCVE-2023-50643 · Other software · Evernote · reported by MITRECritical 9.8
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.
Product
Evernote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com electronjs.org
Jan 2, 2024An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.cCVE-2023-49558 · Other software · Yasm Project · reported by MITREMedium 5.5
An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 2, 2024An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c compCVE-2023-49555 · Other software · Yasm Project · reported by MITREMedium 5.5
An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2023Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted proCVE-2023-6315 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.8
Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file.
Product
Control FPWIN Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record industry.panasonic.eu industry.panasonic.eu
Dec 18, 2023Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted projectCVE-2023-6314 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.8
Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a specially crafted project file.
Product
Control FPWIN Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record industry.panasonic.eu industry.panasonic.eu
Dec 14, 2023Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection stCVE-2023-47261 · Other software · Dokmee · reported by MITRECritical 9.8
Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.
Product
Enterprise Content Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record h3x0s3.github.io dokmee.com
Nov 29, 2023The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.CVE-2023-4474 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allCVE-2023-4473 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21CVE-2023-37928 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.8
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.CVE-2023-37927 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.8
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versioCVE-2023-35138 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Nov 29, 2023An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABCVE-2023-35137 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.5
An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Nov 9, 2023Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in thCVE-2023-45885 · Other software · Nasa · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.
Product
Openmct
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record linkedin.com linkedin.com
Nov 9, 2023Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayoCVE-2023-45884 · Other software · Nasa · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.
Product
Openmct
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record linkedin.com linkedin.com
Oct 6, 2023In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.CVE-2023-45282 · Other software · Nasa · reported by MITREHigh 7.5
In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.
Product
Openmct
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 20, 2023Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, gCVE-2023-43375 · Other software · Digitaldruid · reported by MITRECritical 9.8
Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters.
Product
Hoteldruid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record flashy-lemonade-192.notion.site flashy-lemonade-192.notion.site
Sep 7, 2023An Issue in Buffalo America, Inc.CVE-2023-39620 · Other software · buffalo_america_inc · reported by MITREHigh 7.5
An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function.
Product
terastation_nas_ts5410r
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 6, 2023Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.CVE-2023-3472 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 8.6
Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.
Product
KW Watcher on Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www3.panasonic.biz www3.panasonic.biz
Sep 6, 2023Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.CVE-2023-3471 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 8.6
Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.
Product
KW Watcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www3.panasonic.biz www3.panasonic.biz
Aug 22, 2023Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash).CVE-2023-38668 · Other software · Nasm · reported by MITREMedium 5.5
Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash).
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service.CVE-2023-38667 · Other software · Nasm · reported by MITREMedium 5.5
Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash).CVE-2023-38665 · Other software · Nasm · reported by MITREMedium 5.5
Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash).
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file.CVE-2022-29654 · Other software · Nasm · reported by MITREMedium 5.5
Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gcc.gnu.org gist.github.com
Aug 22, 2023Buffer Overflow vulnerability in scan function in stdscan.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.CVE-2020-21687 · Other software · Nasm · reported by MITREMedium 5.5
Buffer Overflow vulnerability in scan function in stdscan.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of serviceCVE-2020-21686 · Other software · Nasm · reported by MITREMedium 5.5
A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023Buffer Overflow vulnerability in hash_findi function in hashtbl.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.CVE-2020-21685 · Other software · Nasm · reported by MITREMedium 5.5
Buffer Overflow vulnerability in hash_findi function in hashtbl.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 22, 2023A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service viaCVE-2020-21528 · Other software · Nasm · reported by MITREMedium 5.5
A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us security.gentoo.org
Aug 22, 2023A Use After Free vulnerability in function new_Token in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of service via crafted nasm command.CVE-2020-18780 · Other software · Nasm · reported by MITREMedium 5.5
A Use After Free vulnerability in function new_Token in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of service via crafted nasm command.
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
Aug 20, 2023TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object InstantiaCVE-2022-24989 · Other software · terra-master · reported by MITRECritical 9.8
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
Product
terramaster_operating_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record attackerkb.com forum.terra-master.com
Aug 15, 2023An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run coCVE-2023-39659 · Other software · Langchain · reported by MITRECritical 9.8
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
Product
Langchain
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2023 AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device CVE-2023-37216 · Other software · AnaSystem · reported by cna@cyber.gov.ilHigh 7.5
AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the device
Product
SensMini M4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gov.il gov.il
Jul 21, 2023A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specialCVE-2023-28730 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.8
A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
Product
Control FPWIN Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record industry.panasonic.eu industry.panasonic.eu
Jul 21, 2023A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specialCVE-2023-28729 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.8
A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
Product
Control FPWIN Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record industry.panasonic.eu industry.panasonic.eu
Jul 21, 2023A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening speciallCVE-2023-28728 · Other software · Panasonic · reported by product-security@gg.jp.panasonic.comHigh 7.8
A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
Product
Control FPWIN Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record industry.panasonic.eu industry.panasonic.eu
Jun 19, 2023Zyxel Multiple NAS Devices Command Injection VulnerabilityCVE-2023-27992 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
May 29, 2023The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker wiCVE-2023-27988 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.2
The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
May 24, 2023Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.CVE-2021-25749 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 7.8
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
Product
Kubernetes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record groups.google.com groups.google.com
May 22, 2023Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.CVE-2023-31996 · Other software · Hanwhavision · reported by MITREHigh 8.8
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.
Product
Ane-l6012r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hanwhavisionamerica.com hanwhavision.com
May 17, 2023yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c.CVE-2023-31725 · Other software · Yasm Project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 17, 2023yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.CVE-2023-31724 · Other software · Yasm Project · reported by MITREHigh 7.8
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 17, 2023yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.CVE-2023-31723 · Other software · Yasm Project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 17, 2023There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).CVE-2023-31722 · Other software · Nasm · reported by MITREHigh 7.8
There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).
Product
Netwide Assembler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.nasm.us bugzilla.nasm.us
May 9, 2023yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c.CVE-2023-31973 · Other software · tortall · reported by MITREMedium 5.5
yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
Product
yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 9, 2023yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c.CVE-2023-31974 · Other software · Tortall · reported by MITREMedium 5.5
yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 9, 2023yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c.CVE-2023-31972 · Other software · Tortall · reported by MITREMedium 5.5
yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.
Product
Yasm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.