Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Jun 4, 2026Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.CVE-2026-49204 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Medium 6.9
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
- Product
- Connect M6E 5G Portable WiFi Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remCVE-2026-6912 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.
- Product
- AWS Ops Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Dec 12, 2024Cognito Forms: Stored Cross-Site ScriptingCVE-2024-10182 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Cognito Forms
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Cognito Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2024A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attackeCVE-2024-42834 · Other software · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the lastName parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authoriCVE-2024-52311 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.3
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.
- Product
- data.all
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 19, 2023Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.CVE-2023-22893 · Other software · Strapi · reported by MITREHigh 7.5
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
- Product
- Strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023Login with Cognito: Does not sanitise and escape some of its settingsCVE-2022-4200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login with Cognito
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Login with Cognito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2022NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.CVE-2020-9754 · Other software · NAVER · reported by cve@navercorp.comMedium 5.3
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Nov 2, 2021Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-37982 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Aug 8, 2019Cognitoys Dino devices allow profiles_add.html CSRF.CVE-2017-18485 · Other software · Elementalpath · reported by MITREMedium 5.4
Cognitoys Dino devices allow profiles_add.html CSRF.
- Product
- Cognitoys Dino Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentestpartners.compentestpartners.com
Aug 8, 2019Cognitoys Dino devices allow XSS via the SSID.CVE-2017-18484 · Other software · Elementalpath · reported by MITREMedium 6.1
Cognitoys Dino devices allow XSS via the SSID.
- Product
- Cognitoys Dino Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentestpartners.compentestpartners.com
Jun 27, 2019A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had CVE-2018-6118 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Apr 22, 2019A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before CVE-2016-1586 · Other software · Ubuntu · reported by security@ubuntu.comLow 1.8
A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3.
- Product
- Oxide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.launchpad.netgit.launchpad.net
Apr 4, 2019Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service.CVE-2018-19981 · Other software · Amazon · reported by MITREHigh 7.2
Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).
- Product
- AWS Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws-amplify.github.ioraw.githubusercontent.com
Dec 4, 2018A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote aCVE-2018-6086 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Sep 21, 2018Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.CVE-2018-14891 · Other software · Vectra · reported by MITREHigh 7.8
Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.
- Product
- Cognito
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.CVE-2018-14890 · Other software · Vectra · reported by MITREMedium 5.4
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.
- Product
- Cognito
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.CVE-2018-14889 · Websites & servers · Apache · reported by MITREHigh 7.8
CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.
- Product
- Couchdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2017Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote serCVE-2017-8867 · Other software · Cognitoys · reported by MITREMedium 5.9
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote server, allowing a malicious user to map encrypted traffic to a particular AES key index and gaining further access to eavesdrop on privacy-sensitive voice communication of a child and their Dino device.
- Product
- Stemosaur Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2017Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a diffCVE-2017-8866 · Other software · Cognitoys · reported by MITREMedium 5.9
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server.
- Product
- Stemosaur Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2017Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an atCVE-2017-8865 · Other software · Cognitoys · reported by MITREMedium 5.9
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device.
- Product
- Stemosaur Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2017Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes theCVE-2017-9615 · Other software · Cognito · reported by MITRECritical 9.8
Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.
- Product
- Moneyworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcognito.co.nzgist.github.com
Sep 18, 2014The INCOgnito Private Browser (aka com.SL.InCoBrowser) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-thCVE-2014-5936 · Other software · Incognito Private Browser Project · reported by cret@cert.orgMedium 5.4
The INCOgnito Private Browser (aka com.SL.InCoBrowser) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Incognito Private Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 31, 2002iSMTP 5.0.1 allows remote attackers to cause a denial of service via a long "MAIL FROM" command, possibly triggering a buffer overflow.CVE-2002-1985 · Other software · Incognito Software INC · reported by MITREMedium 5
iSMTP 5.0.1 allows remote attackers to cause a denial of service via a long "MAIL FROM" command, possibly triggering a buffer overflow.
- Product
- Ismtp Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.