Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
180 results · page 1 of 4
Oct 23, 2026Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android alCVE-2026-114353 · Other software · DJI · reported by vulnerability@ncsc.chHigh 7
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 21, 2026odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript.CVE-2026-113787 · Other software · GitHubNewbie0 · reported by GitHubMedium 6.1
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vert
- Product
- odf-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documCVE-2026-111364 · Other software · mindoc-org · reported by VulnCheckHigh 7.1
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
- Product
- MinDoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office doCVE-2026-108750 · Other software · OpenDocMan · reported by VulnCheckMedium 5.3
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
- Product
- OpenDocMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invoCVE-2026-108694 · Other software · C4illin · reported by VulnCheckHigh 7.1
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
- Product
- ConvertX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended CVE-2026-100295 · Other software · Anjvision · reported by ics-cert@hq.dhs.govMedium 5.3
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.
- Product
- YSSD-RTMP-H5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changedCVE-2026-92928 · Other software · OpenEye · reported by contact@securifera.comMedium 6.5
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.
- Product
- Apex Network Video Recorder (NVR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.openeye.netsecurifera.com
Sep 8, 2026WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path.CVE-2026-86729 · Other software · WWBN · reported by VulnCheckCritical 9.1
WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local fileCVE-2026-81659 · Other software · flowintel · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.
- Product
- flowintel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication.CVE-2026-18164 · Other software · Flow Neuroscience · reported by ics-cert@hq.dhs.govHigh 7.2
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.
- Product
- FL-100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/gCVE-2026-68586 · Other software · siyuan-note · reported by VulnCheckCritical 9.2
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 31, 2026The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging levCVE-2026-65311 · Other software · ANDRITZ · reported by office@cyberdanube.comMedium 5.3
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.
- Product
- HIPASE-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51.CVE-2026-8982 · Other software · Autel · reported by office@cyberdanube.comCritical 10
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.
- Product
- MaxiCharger Single
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Shamefile is a linter for undocumented linter warnings.CVE-2026-47144 · Other software · BKDDFS · reported by GitHubMedium 5.5
Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.
- Product
- shamefile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an APICVE-2026-12593 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3High 8.7
The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so. Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.
- Product
- Axivion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.CVE-2026-59998 · Other software · OpenBSD · reported by MITREMedium 4.8
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commCVE-2026-35906 · Other software · reported by MITRECritical 9.6
An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comt3techgroup.com
Jun 3, 2026Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticCVE-2026-36615 · Other software · reported by MITREMedium 4.3
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint.CVE-2026-2812 · Other software · Esri · reported by psirt@esri.comMedium 5.3
ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras.CVE-2026-8598 · Other software · ZKTeco · reported by ics-cert@hq.dhs.govCritical 9.1
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
- Product
- SSC335-GC2063-Face-0b77 Solution Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup.CVE-2026-6501 · Other software · ILM Informatique · reported by 64c5ae8f-7972-4697-86a0-7ada793ac795Medium 5.3
Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This issue affects jOpenDocument: 1.5.
- Product
- jOpenDocument
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.CVE-2026-1952 · Other software · DeltaWW · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.8
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
- Product
- AS320T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Apr 16, 2026In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead tCVE-2023-3634 · Other software · Festo · reported by info@cert.vde.comHigh 8.8
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- Product
- MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comfesto.csaf-tp.certvde.com
Apr 5, 2026OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the CVE-2019-25684 · Other software · opendocman · reported by VulnCheckHigh 8.8
OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.
- Product
- OpenDocMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Mar 9, 2026A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the systCVE-2025-41756 · Other software · MBS · reported by info@cert.vde.comHigh 8.1
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
- Product
- UBR-01 Mk II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the systeCVE-2025-41754 · Other software · MBS · reported by info@cert.vde.comMedium 6.5
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.
- Product
- UBR-01 Mk II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user accoCVE-2026-28778 · Other software · International Datacasting Corporation (IDC) · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.9
International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because the `xd` user has write permissions to their home directory where root-executed binaries and symlinks (such as those invoked by `xdstartstop`) are stored, the attacker can overwrite these files or manipulate symlinks to achieve arbitrary code execution as the root user.
- Product
- IDC SFX2100 SuperFlex Satellite Receiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` fCVE-2025-56005 · Other software · Red Hat · reported by MITRECritical 9.8
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Product
- Fence Agents Remediation Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-sCVE-2020-36905 · Other software · FIBAR GROUP S.A. · reported by VulnCheckMedium 5.1
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
- Product
- Home Center 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Dec 24, 2025Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes.CVE-2018-25146 · Other software · Microhard Systems · reported by VulnCheckHigh 7.1
Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service disruption and requiring device restart.
- Product
- Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Service Control DoS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrohardcorp.comexploit-db.com
Dec 13, 2025Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, suCVE-2025-36752 · Other software · Growatt · reported by csirt@divd.nlCritical 9.4
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.
- Product
- ShineLan-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestriCVE-2025-65294 · Other software · Aqara · reported by MITRECritical 9.8
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented pageCVE-2021-47731 · Other software · Selea s.r.l. · reported by VulnCheckCritical 9.3
Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented page. Attackers can exploit the hidden endpoint by using the hard-coded password 'Selea781830' to enable configuration upload and overwrite device settings.
- Product
- Selea Targa IP OCR-ANPR Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 9, 2025An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g.CVE-2025-41697 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.8
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access CVE-2025-41696 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 4.6
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-sCVE-2025-64139 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
- Product
- Jenkins Start Windocks Containers Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 29, 2025A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specifiCVE-2025-64138 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
- Product
- Jenkins Start Windocks Containers Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 24, 2025Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLUCVE-2025-12176 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet administrative interface that allows remote authentiCVE-2017-20204 · Other software · DBL Technology (DBLTek) · reported by VulnCheckCritical 9.3
DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet administrative interface that allows remote authentication as an undocumented user via a proprietary challenge–response scheme which is fundamentally flawed. Because the challenge response can be computed from the challenge itself, a remote attacker can authenticate without knowledge of a secret and obtain a root shell on the device. This can lead to persistent remote code execution, full device compromise, and arbitrary control of the device and any managed services. The firmware used within these devices was updated in December 2016 to make this vulnerability more complex to exploit. However, it is unknown if DBLTek has taken steps to fully mitigate.
- Product
- GoIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SCVE-2025-34217 · Other software · Vasion · reported by VulnCheckCritical 10
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'NOPASSWD: ALL'. Possession of the matching private key gives an attacker root access to the appliance.
- Product
- Print Virtual Appliance Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.comhelp.printerlogic.com
Sep 22, 2025SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc.CVE-2025-42907 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.
- Product
- SAP BI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaCVE-2025-57440 · Other software · reported by MITREHigh 7.5
The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage devices, and system reboot. This interface, referred to as the "ATEM Ethernet Protocol 1.0", provides complete device control without requiring credentials or encryption. An attacker on the same network (or with remote access to the exposed port) can exploit this interface to execute arbitrary streaming commands, erase disks, or shut down the device - effectively gaining full remote control.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comblackmagicdesign.com
Sep 9, 2025CWE-1242: Inclusion of Undocumented FeaturesCVE-2025-55050 · Other software · Baicells · reported by cna@cyber.gov.ilCritical 9.8
CWE-1242: Inclusion of Undocumented Features
- Product
- NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.CVE-2025-41688 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.2
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
- Product
- mbNET HW1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Jul 15, 2025An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocCVE-2025-34103 · Other software · WePresent (Barco) · reported by VulnCheckCritical 9.3
An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user.
- Product
- WiPG-1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comexploit-db.com
Jul 11, 2025An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials.CVE-2025-7503 · Other software · Shenzhen Liandian Communication Technology LTD · reported by 1c6b5737-9389-4011-8117-89fa251edfb2Critical 10
An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user manual. An attacker with network access can authenticate using default credentials and gain root-level shell access to the device. The affected firmware version is AppFHE1_V1.0.6.0 (Kernel: KerFHE1_PTZ_WIFI_V3.1.1, Hardware: HwFHE1_WF6_PTZ_WIFI_20201218). No official fix or firmware update is available, and the vendor could not be contacted. This vulnerability allows for remote code execution and privilege escalation.
- Product
- V380 IP Camera / AppFHE1_V1.0.6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted ifrCVE-2025-51591 · Other software · reported by MITRELow 3.7
A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific porCVE-2025-5310 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordociocisa.sharepoint.comcisa.gov
Jun 11, 2025The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem.CVE-2025-26412 · Other software · SIMCom · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.8
The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands.
- Product
- SIM7600G Modem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Jun 10, 2025Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated CVE-2025-41657 · Other software · Auma · reported by info@cert.vde.comMedium 4.3
Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker.
- Product
- AC1.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.