Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Jun 23, 2025Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing cCVE-2025-2172 · Other software · Aviatrix · reported by mandiant-cve@google.comMedium 6.6
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud.google.comgithub.com
Jun 23, 2025Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute forceCVE-2025-2171 · Other software · Aviatrix · reported by mandiant-cve@google.comHigh 7.8
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloud.google.comgithub.com
Jan 7, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · Aviatrix · reported by MITREExploitedCritical 10
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
- Product
- Controllers
- On CISA’s list since
- Jan 16, 2025 (federal fix deadline Feb 6, 2025)
- What to do
- Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocs.aviatrix.comdocs.aviatrix.com
Sep 13, 2021Aviatrix Controller Unrestricted Upload of FileCVE-2021-40870 · Other software · Aviatrix · reported by MITREExploitedCritical 9.8
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
- Product
- Aviatrix Controller
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comdocs.aviatrix.com
Apr 21, 2021Insecure File Permissions exist in Aviatrix Controller 5.3.1516.CVE-2020-27568 · Other software · Aviatrix · reported by MITREHigh 7.5
Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller resource. Note: All Aviatrix appliances are fully encrypted. This is an extra layer of security.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comdocs.aviatrix.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R6.0.2483.CVE-2020-26553 · Other software · Aviatrix · reported by MITRECritical 9.8
An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R6.0.2483.CVE-2020-26552 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for access.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R5.3.1151.CVE-2020-26551 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R5.3.1151.CVE-2020-26550 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R5.4.1290.CVE-2020-26549 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file downloading.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
Nov 17, 2020An issue was discovered in Aviatrix Controller before R5.4.1290.CVE-2020-26548 · Other software · Aviatrix · reported by MITREHigh 8.8
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalstart.comcriticalstart.com
May 22, 2020An issue was discovered in Aviatrix Controller before 5.4.1066.CVE-2020-13416 · Other software · Aviatrix · reported by MITREMedium 6.5
An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comdocs.aviatrix.com
May 22, 2020An issue was discovered in Aviatrix Controller through 5.1.CVE-2020-13415 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comdocs.aviatrix.com
May 22, 2020An issue was discovered in Aviatrix Controller before 5.4.1204.CVE-2020-13414 · Other software · Aviatrix · reported by MITREHigh 7.5
An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comcriticalstart.com
May 22, 2020An issue was discovered in Aviatrix Controller before 5.4.1204.CVE-2020-13413 · Other software · Aviatrix · reported by MITREMedium 5.3
An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comcriticalstart.com
May 22, 2020An issue was discovered in Aviatrix Controller before 5.4.1204.CVE-2020-13412 · Other software · Aviatrix · reported by MITREHigh 8.8
An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.aviatrix.comdocs.aviatrix.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.