Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Jun 25, 2026CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account coCVE-2026-9651 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.7
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.
- Product
- EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jun 25, 2026CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacCVE-2026-9650 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.
- Product
- EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
May 12, 2026CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files wheCVE-2026-6865 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.1
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
- Product
- EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Dec 15, 2023Multisuns EasyLog web+ has a code injection vulnerability.CVE-2023-48390 · Other software · Multisuns · reported by twcert@cert.org.twCritical 9.8
Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service.
- Product
- EasyLog web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL.CVE-2023-48389 · Other software · Multisuns · reported by twcert@cert.org.twHigh 7.5
Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
- Product
- EasyLog web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 15, 2023Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials.CVE-2023-48388 · Other software · Multisuns · reported by twcert@cert.org.twCritical 9.8
Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
- Product
- EasyLog web+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 2, 2021An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used byCVE-2021-22552 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave.CVE-2021-22550 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 6.5
An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended to update past 0.6.3 or git commit https://github.com/google/asylo/commit/a47ef55db2337d29de19c50cd29b0deb2871d31c
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory.CVE-2021-22549 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 6.5
An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter isCVE-2021-22548 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 6.5
An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memory, if the latter is later copied out, it allows for reading of memory regions from the trusted region. It is recommended to update past 0.6.2 or git commit https://github.com/google/asylo/commit/53ed5d8fd8118ced1466e509606dd2f473707a5c
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output whCVE-2020-8944 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory write vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to ecall_restore using the attribute output which fails to check the range of a pointer. An attacker can use this pointer to write to arbitrary memory addresses including those within the secure enclave We recommend upgrading past commit 382da2b8b09cbf928668a2445efb778f76bd9c8a
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvfrom whose return size wasCVE-2020-8943 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvfrom whose return size was not validated against the requested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 6e158d558abd3c29a0208e30c97c9a8c5bd4230f
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was notCVE-2020-8942 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit b1d120a2c7d7446d2cc58d517e20a1b184b82200
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker coCVE-2020-8941 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading past commit 8fed5e334131abaf9c5e17307642fbf6ce4a57ec
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker contCVE-2020-8940 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_recvmsg using an attacker controlled result parameter. The parameter size is unchecked allowing the attacker to read memory locations outside of the intended buffer size including memory addresses within the secure enclave. We recommend upgrading or past commit fa6485c5d16a7355eab047d4a44345a73bc9131e
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within theCVE-2020-8939 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within the enclave heap. We recommend upgrading past commit 6ff3b77ffe110a33a2f93848a6333f33616f02c4
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to FromkLinuxSockAddr with attacker controlled CVE-2020-8938 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to FromkLinuxSockAddr with attacker controlled content and size of klinux_addr which allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a CVE-2020-8937 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to enc_untrusted_create_wait_queue that uses a pointer queue that relies on UntrustedLocalMemcpy, which fails to validate where the pointer is located. This allows an attacker to write memory values from within the enclave. We recommend upgrading past commit a37fb6a0e7daf30134dbbf357c9a518a1026aa02
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall.CVE-2020-8936 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code CVE-2020-8935 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5.3
An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to reallocate untrusted code and overwrite sections of the Enclave memory address. We recommend updating your library.
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to.CVE-2020-8905 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comLow 2.8
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2020An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0.CVE-2020-8904 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 6.4
An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
- Product
- Asylo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019EasyLobby Solo contains default administrative credentials.CVE-2018-17492 · Other software · HID Global · reported by psirt@us.ibm.comHigh 8.4
EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application.
- Product
- EasyLobby Solo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Mar 21, 2019EasyLobby Solo could allow a local attacker to gain elevated privileges on the system.CVE-2018-17491 · Other software · HID Global · reported by psirt@us.ibm.comHigh 8.4
EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the program, an attacker could exploit this vulnerability to perform unauthorized actions on the computer.
- Product
- EasyLobby Solo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Mar 21, 2019EasyLobby Solo is vulnerable to a denial of service.CVE-2018-17490 · Other software · HID Global · reported by psirt@us.ibm.comHigh 7.7
EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit this vulnerability to kill the process or launch new processes at will.
- Product
- EasyLobby Solo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Mar 21, 2019EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext.CVE-2018-17489 · Other software · HID Global · reported by psirt@us.ibm.comLow 2.9
EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintext. By visiting the kiosk and viewing the Visitor table of the database, an attacker could exploit this vulnerability to view stored social security numbers.
- Product
- EasyLobby Solo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Aug 24, 2018An issue was discovered in EasyLogin Pro through 1.3.0.CVE-2018-15576 · Other software · Hazzardweb · reported by MITREHigh 8.1
An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key.
- Product
- Easylogin Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Dec 17, 2007Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles, which allows remote attackers to execute arbitrary code or cause a denial ofCVE-2007-4473 · Other software · Gesytec Easylon · reported by cret@cert.orgHigh 10
Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles, which allows remote attackers to execute arbitrary code or cause a denial of service via unspecified network traffic to the OLE for Process Control (OPC) interface, probably related to free operations on arbitrary memory addresses through certain Remove functions, and read and write operations on arbitrary memory addresses through certain Set, Read, and Write functions.
- Product
- OPC Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.