Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jul 15, 2026A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted inputCVE-2026-38755 · Other software · BusyBox · reported by MITRELow 2.9
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusybox.netlists.busybox.net
Jul 15, 2026A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.CVE-2026-38754 · Other software · BusyBox · reported by MITREMedium 5.1
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusybox.netlists.busybox.net
Jul 15, 2026A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK scCVE-2026-38753 · Other software · BusyBox · reported by MITREMedium 4.9
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbusybox.netlists.busybox.net
Mar 12, 2025Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and CVE-2024-13872 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.4
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device.
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490).CVE-2024-13871 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.4
A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgradCVE-2024-13870 · Other software · Bitdefender · reported by cve-requests@bitdefender.comLow 1.8
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.CVE-2024-48747 · Other software · alist_project · reported by MITREMedium 6.8
An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.
- Product
- alist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.CVE-2023-52069 · Other software · Kodcloud · reported by MITREMedium 5.4
kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Jan 16, 2024kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.CVE-2023-52068 · Other software · Kodcloud · reported by MITREMedium 6.1
kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Dec 7, 2023SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.CVE-2023-39171 · Other software · SENEC · reported by info@cert.vde.comHigh 7.2
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023The affected devices use publicly available default credentials with administrative privileges.CVE-2023-39169 · Other software · SENEC · reported by info@cert.vde.comCritical 9.8
The affected devices use publicly available default credentials with administrative privileges.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.CVE-2023-39172 · Other software · SENEC · reported by info@cert.vde.comCritical 9.1
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.CVE-2023-39167 · Other software · SENEC · reported by info@cert.vde.comHigh 7.5
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Aug 28, 2023An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.CVE-2023-39810 · Other software · Busybox · reported by MITREHigh 7.8
An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- Product
- Busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentagrid.chopenwall.com
Jan 31, 2023Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.CVE-2023-24956 · Other software · Forget Heart Message BOX Project · reported by MITREHigh 8.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
- Product
- Forget Heart Message BOX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.CVE-2023-24241 · Other software · Forget Heart Message BOX Project · reported by MITRECritical 9.8
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
- Product
- Forget Heart Message BOX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/filter.c:1454, as demonstrated by GPAC.CVE-2021-40942 · Other software · Gpac · reported by MITREMedium 5.5
In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/filter.c:1454, as demonstrated by GPAC. This can cause a denial of service (DOS).
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability.CVE-2021-41458 · Other software · Gpac · reported by MITREMedium 5.5
In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability.
- Product
- Mp4box
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a deniCVE-2021-41459 · Other software · Gpac · reported by MITREHigh 7.5
There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability.
- Product
- Mp4box
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denialCVE-2021-41456 · Other software · Gpac · reported by MITREHigh 7.5
There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.
- Product
- Mp4box
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.