Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Sep 11, 2026NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could reCVE-2026-82583 · Other software · NextGen Healthcare · reported by ics-cert@hq.dhs.govHigh 7.2
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictionsCVE-2026-82578 · Other software · NextGen Healthcare · reported by ics-cert@hq.dhs.govHigh 8.7
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-sCVE-2026-78224 · Other software · NextGen Healthcare · reported by ics-cert@hq.dhs.govHigh 8.8
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023NextGen Healthcare Mirth Connect Deserialization of Untrusted Data VulnerabilityCVE-2023-43208 · Other software · NextGen Healthcare · reported by MITREExploitedRansomwareCritical 9.8
NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.
- Product
- Mirth Connect
- On CISA’s list since
- May 20, 2024 (federal fix deadline Jun 10, 2024)
- What to do
- Attackers are using this now. Install NextGen Healthcare’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comhorizon3.ai
Aug 2, 2023A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.CVE-2023-37679 · Other software · Nextgen · reported by MITRECritical 9.8
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comihteam.net
Jul 31, 2017MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access.CVE-2017-11743 · Other software · Medhost · reported by MITRECritical 9.8
MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensitive patient information. The admin account password is hard-coded as $K8t1ng throughout the application, and is the same across all installations. Customers do not have the option to change the Mirth Connect admin account password. The Mirth Connect admin account is created during the Connex install. The plaintext account password is hard-coded multiple times in the Connex install and update scripts.
- Product
- Connex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.