Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Aug 14, 2026An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a CVE-2026-19679 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.7
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.CVE-2026-45430 · Other software · Backdrop CMS contributed projects · reported by MITREHigh 7.1
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
- Product
- backdrop-contrib/salesforce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute CVE-2024-54840 · Other software · CyberArk · reported by MITREMedium 4.2
PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection.
- Product
- Privileged Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comgist.github.com
May 27, 2024rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface.CVE-2024-35231 · Other software · rack · reported by GitHubHigh 8.6
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.
- Product
- rack-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the passwCVE-2023-34995 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 7.5
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation.CVE-2022-25273 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation.CVE-2022-25271 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 7, 2019Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and CVE-2010-2472 · Websites & servers · drupal6 · reported by Red HatMedium 4.8
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
- Product
- drupal6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgdrupal.org
Sep 25, 2019Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributedCVE-2019-10407 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.
- Product
- Jenkins Project Inheritance Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 9, 2019The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.CVE-2019-16145 · Other software · Padrinorb · reported by MITREMedium 6.1
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
- Product
- Padrino-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2016The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a CVE-2016-6211 · Websites & servers · Drupal · reported by MITREHigh 8.8
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
- Product
- Drupal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Apr 12, 2016The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls theCVE-2016-3169 · Other software · Debian · reported by MITREHigh 8.1
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgopenwall.com
Sep 30, 2012Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated useCVE-2012-2153 · Websites & servers · Drupal · reported by Red HatMedium 4
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
- Product
- Drupal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2008Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allowCVE-2008-3222 · Websites & servers · Drupal · reported by MITREMedium 5.8
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
- Product
- Drupal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2006Adobe Contribute Publishing Server leaks the administrator password in logs that are created during product installation, which allows local users to gain priviCVE-2006-5199 · Other software · Adobe · reported by MITRELow 2.1
Adobe Contribute Publishing Server leaks the administrator password in logs that are created during product installation, which allows local users to gain privileges to the server.
- Product
- Contribute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Jun 7, 2006Cross-site scripting (XSS) vulnerability in the Contributed Packages for PyBlosxom 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HCVE-2006-2880 · Other software · Pyblosxom · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in the Contributed Packages for PyBlosxom 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the Comments plugin in the (1) url and (2) author fields.
- Product
- Pyblosxom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsourceforge.net
Dec 31, 2005Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group peCVE-2005-4708 · Other software · Adobe · reported by MITREHigh 7.2
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
- Product
- Captivate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Nov 24, 2005Macromedia Contribute Publishing Server (CPS) before 1.11 uses a weak algorithm to encrypt user password in connection keys that use shared FTP login credentialCVE-2005-3800 · Other software · reported by MITREMedium 5
Macromedia Contribute Publishing Server (CPS) before 1.11 uses a weak algorithm to encrypt user password in connection keys that use shared FTP login credentials, which allows attackers to obtain sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Sep 28, 2005Directory traversal vulnerability in Avi Alkalay contribute.cgi (aka contribute.pl), dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files viaCVE-2005-3097 · Other software · AVI Alkalay · reported by MITREMedium 5
Directory traversal vulnerability in Avi Alkalay contribute.cgi (aka contribute.pl), dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files via ".." sequences in the contribdir variable.
- Product
- Contribute.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2005A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.CVE-2005-1851 · Other software · EKG · reported by security@debian.orgHigh 10
A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
- Product
- EKG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2005Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnCVE-2005-1850 · Other software · EKG · reported by security@debian.orgHigh 10
Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
- Product
- EKG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2004The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install CVE-2004-2335 · Other software · Macromedia · reported by MITREHigh 7.2
The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.
- Product
- Contribute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commacromedia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.