Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Feb 9, 2026Hollo is a federated single-user microblogging software designed to be federated through ActivityPub.CVE-2026-25808 · Other software · fedify-dev · reported by GitHubHigh 7.5
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
- Product
- hollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025WP Admin Microblog: Cross-Site Request ForgeryCVE-2025-12173 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Admin Microblog plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'wp-admin-microblog' page. This makes it possible for unauthenticated attackers to send messages on behalf of an administrator via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Admin Microblog
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update WP Admin Microblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 13, 2025Vickey is a Misskey-based microblogging platform.CVE-2025-61775 · Other software · Whimsies-YAT · reported by GitHubMedium 6.9
Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address could receive repeated confirmation messages if the verification link was accessed multiple times. This issue may result in unintended email traffic but does not expose user data. The issue was addressed in version 2025.10.0 by improving validation logic to ensure verification links behave as expected after completion.
- Product
- Vickey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Hollo is a federated single-user microblogging software designed to be federated through ActivityPub.CVE-2025-53941 · Other software · fedify-dev · reported by GitHubMedium 6.1
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.
- Product
- hollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Microblog Poster: Cross-Site Request Forgery (CSRF)CVE-2025-31435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: from n/a through <= 2.1.6.
- Product
- Microblog Poster
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Microblog Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2025Mastodon is a self-hosted, federated microblogging platform.CVE-2025-27399 · Other software · mastodon · reported by GitHubMedium 5.3
Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
- Product
- mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Mastodon is a self-hosted, federated microblogging platform.CVE-2025-27157 · Other software · mastodon · reported by GitHubMedium 5.3
Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
- Product
- mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey.CVE-2025-24973 · Other software · nexryai · reported by GitHubCritical 9.3
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.
- Product
- concorde
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey.CVE-2025-24900 · Other software · nexryai · reported by GitHubHigh 8.6
Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to 12.25Q1.1, the authentication cookie does not have the SameSite attribute. This allows an attacker to bypass MediaProxy authentication and load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, this cookie was also used to authenticate the job queue management page (bull-board), so bull-board authentication is also bypassed. This may enable attacks that have a significant impact on availability and integrity. The affected versions are too old to be covered by this advisory, but the maintainers of Concorde strongly recommend not using older versions. Version 12.25Q1.1 contains a patch. There is no effective workaround other than updating.
- Product
- concorde
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Mastodon is a self-hosted, federated microblogging platform.CVE-2024-37903 · Other software · mastodon · reported by GitHubHigh 8.2
Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.
- Product
- mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Misskey is an open source, decentralized microblogging platform.CVE-2024-32983 · Other software · misskey-dev · reported by GitHubHigh 8.2
Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023nexkey is a microblogging platform.CVE-2023-49095 · Other software · nexryai · reported by GitHubHigh 8.6
nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
- Product
- nexkey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Misskey is an open source, decentralized microblogging platform.CVE-2021-39195 · Other software · misskey-dev · reported by GitHubHigh 7.7
Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2021Misskey is a decentralized microblogging platform.CVE-2021-39169 · Other software · misskey-dev · reported by GitHubHigh 8
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.
- Product
- misskey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2019The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.CVE-2015-9449 · WordPress plugins & themes · reported by MITREHigh 7.2
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
- Product
- microblog-poster
- Fixed in
- 1.6.2
- What to do
- Update microblog-poster to 1.6.2 or newer.
Jan 5, 2015Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to theCVE-2014-9516 · Other software · Social Microblogging Pro Project · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI, related to the "Web Site" input in the Profile section.
- Product
- Social Microblogging Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgexploit-db.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web CVE-2014-4590 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the oauth_verifier parameter.
- Product
- WP Microblogs
- Affected
- up to 0.4.0
- What to do
- Affects up to 0.4.0. Update WP Microblogs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jan 24, 2012The Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do not properly protect data, which allows remote attackers to read CVE-2011-4865 · Other software · Tencent · reported by MITREMedium 5.8
The Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do not properly protect data, which allows remote attackers to read or modify message drafts and search keywords via a crafted application.
- Product
- Microblogpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww4.comp.polyu.edu.hkwww4.comp.polyu.edu.hk
Sep 23, 2011MicroBlog 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mesCVE-2011-3756 · Other software · Microblog · reported by MITREMedium 5
MicroBlog 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by init.php and certain other files.
- Product
- Microblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
Jan 17, 2006SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parametCVE-2006-0234 · Other software · Microblog · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.
- Product
- Microblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2006Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascripCVE-2006-0233 · Other software · Microblog · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.
- Product
- Microblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevuln.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.