Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

65 results · page 1 of 2

Oct 30, 2026gopacket provides packet processing capabilities for Go.CVE-2026-119299 · Other software · gopacket · reported by GitHubMedium 5.9
gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, and decodeSCTPParameter without checking that each chunk contains the fixed fields, parameter TLVs, gap acknowledgements, or duplicate TSNs those sub-decoders read. A crafted SCTP segment can therefore cause out-of-bounds or inverted slice panics; the panic can terminate applications that use gopacket.DecodeOptions.SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic enabled, while the default recovery-enabled APIs convert it to a per-packet decode error. This is the SCTP sub-decoder residual named but not remediated by CVE-2026-65819, whose version 1.7.1 changes bounded the generic dispatcher but left these per-type reads and loops unchecked. The impact is availability only, with no data disclosure, modification, or allocation amplification. This issue is fixed in version 1.7.2.
Product
gopacket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parametCVE-2026-107082 · Other software · reported by MITREHigh 8.8
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026gopacket provides packet processing capabilities for Go.CVE-2026-65819 · Other software · gopacket · reported by GitHubHigh 7.5
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
Product
gopacket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2026gopacket provides packet processing capabilities for Go.CVE-2026-54345 · Other software · gopacket · reported by GitHubMedium 6.9
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header underflows the unsigned 32-bit value and drives an unbounded allocation of roughly 4 GiB, and two such messages in succession OOM-kill a collector, causing an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Product
gopacket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2026gopacket provides packet processing capabilities for Go.CVE-2026-54332 · Other software · gopacket · reported by GitHubMedium 6.9
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Product
gopacket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 21, 2026A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU uCVE-2026-44907 · Other software · Meta · reported by cve-assign@fb.comHigh 7.5
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).
Product
react-server-dom-turbopack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 26, 2026A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticatedCVE-2026-50766 · Other software · Koha · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).
Product
Koha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lgnas.gitbook.io lgnas.gitbook.io
May 6, 2026A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes,CVE-2026-23870 · Other software · Meta · reported by cve-assign@fb.comHigh 7.5
A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
Product
react-server-dom-turbopack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 8, 2026A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and rCVE-2026-23869 · Other software · Meta · reported by cve-assign@fb.comHigh 7.5
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
Product
react-server-dom-turbopack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com access.redhat.com
Apr 8, 2026NitroPack: Missing AuthorizationCVE-2026-39669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
Product
NitroPack
Affected
up to 1.19.3
What to do
Affects up to 1.19.3. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 16, 2026A weakness has been identified in Topsec TopACM 3.0.CVE-2026-4170 · Other software · Topsec · reported by VulDBHigh 8.9
A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_sync.php of the component HTTP Request Handler. Executing a manipulation of the argument template_path can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Product
TopACM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.feishu.cn vuldb.com
Dec 23, 2025PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote CVE-2023-53982 · Other software · Sigb · reported by VulnCheckCritical 9.3
PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks.
Product
PMB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forge.sigb.net sigb.net
Nov 25, 2025SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parametersCVE-2025-61167 · Other software · Sigb · reported by MITREMedium 6.5
SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameters.
Product
PMB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forge.sigb.net gist.github.com
Nov 5, 2025PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component.CVE-2025-63334 · Other software · Magdesign · reported by MITRECritical 9.8
PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.
Product
Pocketvj Control Panel Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Sep 10, 2025NitroPack: Unauthorized modification of dataCVE-2025-8778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.
Product
NitroPack
Affected
up to 1.18.4
What to do
Affects up to 1.18.4. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2025Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters.CVE-2010-20112 · Other software · Amlib · reported by VulnCheckCritical 9.3
Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments
Product
Amlibweb Library Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.checkpoint.com raw.githubusercontent.com
Jul 25, 2025A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05.CVE-2025-52360 · Other software · reported by MITREHigh 8.8
A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jul 16, 2025Videopack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.
Product
Videopack
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update Videopack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 28, 2025AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code.CVE-2024-48310 · Other software · reported by MITREHigh 7.5
AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Jan 15, 2025NitroPack: Unauthorized arbitrary transient updateCVE-2024-11851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
Product
NitroPack
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2025NitroPack: Unauthorized modification of dataCVE-2024-11848 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition.
Product
NitroPack
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2024Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability.CVE-2024-11021 · Other software · Grand Vice info · reported by twcert@cert.org.twMedium 5.4
Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser.
Product
Webopac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 11, 2024Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and deCVE-2024-11020 · Other software · Grand Vice info · reported by twcert@cert.org.twCritical 9.8
Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
Webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 11, 2024Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code CVE-2024-11019 · Other software · Grand Vice info · reported by twcert@cert.org.twMedium 6.1
Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.
Product
Webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 11, 2024Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which coCVE-2024-11018 · Other software · Grand Vice info · reported by twcert@cert.org.twCritical 9.8
Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which could lead to arbitrary code execution on the server.
Product
Webopac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 11, 2024Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, CVE-2024-11017 · Other software · Grand Vice info · reported by twcert@cert.org.twHigh 8.8
Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server.
Product
Webopac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 11, 2024Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and deCVE-2024-11016 · Other software · Grand Vice info · reported by twcert@cert.org.twCritical 9.8
Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
Webopac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Aug 29, 2024NitroPack: Improper Control of Generation of Code ('Code Injection')CVE-2024-43922 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7.
Product
NitroPack
Affected
up to 1.16.7
What to do
Affects up to 1.16.7. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 1, 2024Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS).CVE-2024-6050 · Other software · SOKRATES-software · reported by cvd@cert.plMedium 5.3
Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects SOWA OPAC software in versions from 4.0 before 4.9.10, from 5.0 before 6.2.12.
Product
SOWA OPAC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cert.pl
May 14, 2024Elevation of privilege vulnerability in GE HealthCare EchoPAC productsCVE-2024-27110 · Other software · GE HealthCare · reported by 171caf72-b841-4e04-a68e-93493aff2b94High 8.4
Elevation of privilege vulnerability in GE HealthCare EchoPAC products
Product
EchoPAC Software Only
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityupdate.gehealthcare.com securityupdate.gehealthcare.com
May 14, 2024Insufficiently protected credentials in GE HealthCare EchoPAC productsCVE-2024-27109 · Other software · GE HealthCare · reported by 171caf72-b841-4e04-a68e-93493aff2b94High 7.6
Insufficiently protected credentials in GE HealthCare EchoPAC products
Product
EchoPAC Software Only
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityupdate.gehealthcare.com securityupdate.gehealthcare.com
May 14, 2024Non privileged access to critical file vulnerability in GE HealthCare EchoPAC productsCVE-2024-27108 · Other software · GE HealthCare · reported by 171caf72-b841-4e04-a68e-93493aff2b94Medium 6.8
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Product
EchoPAC Software Only
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityupdate.gehealthcare.com securityupdate.gehealthcare.com
May 14, 2024Weak account password in GE HealthCare EchoPAC productsCVE-2024-27107 · Other software · GE HealthCare · reported by 171caf72-b841-4e04-a68e-93493aff2b94Critical 9.6
Weak account password in GE HealthCare EchoPAC products
Product
EchoPAC Software Only
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityupdate.gehealthcare.com securityupdate.gehealthcare.com
May 14, 2024Vulnerable data in transit in GE HealthCare EchoPAC productsCVE-2024-27106 · Other software · GE HealthCare · reported by 171caf72-b841-4e04-a68e-93493aff2b94Medium 5.7
Vulnerable data in transit in GE HealthCare EchoPAC products
Product
EchoPAC Software Only
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityupdate.gehealthcare.com securityupdate.gehealthcare.com
Feb 21, 2024A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQCVE-2023-52153 · Other software · pmb_project · reported by MITRECritical 9.8
A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value.
Product
pmb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nexacybersecurity.blogspot.com nexacybersecurity.blogspot.com
Jan 5, 2024NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: Cross-Site Request Forgery (CSRF)CVE-2023-52121 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.
Product
NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a confused deputy.CVE-2023-40092 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Mar 6, 2023PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php.CVE-2023-24735 · Other software · Sigb · reported by MITREMedium 6.1
PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.
Product
PMB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 14, 2022Cross-site Scripting (XSS) vulnerability in the search functionality of AlCoda NetBiblio WebOPAC allows an unauthenticated user to craft a reflected Cross-Site CVE-2021-42551 · Other software · AlCoda · reported by vulnerability@ncsc.chMedium 6.1
Cross-site Scripting (XSS) vulnerability in the search functionality of AlCoda NetBiblio WebOPAC allows an unauthenticated user to craft a reflected Cross-Site Scripting attack. This issue affects: AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320; versions later than 4.0.0.328. This issue does not affect: AlCoda NetBiblio WebOPAC version 4.0.0.335 and later versions.
Product
NetBiblio WebOPAC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record redguard.ch redguard.ch
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2021Grand Vice info Co.CVE-2021-42839 · Other software · Grand Vice info Co. · reported by twcert@cert.org.twHigh 8.8
Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.
Product
webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 15, 2021Grand Vice info Co.CVE-2021-42838 · Other software · Grand Vice info Co. · reported by twcert@cert.org.twMedium 6.1
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks.
Product
webopac7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Nov 19, 2020A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.CVE-2020-28350 · Other software · Sokrates · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.
Product
Sowasql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Apr 17, 2020In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification CVE-2020-0080 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification icon that it's overlaying. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-144092031
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Aug 9, 2019The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.CVE-2019-14792 · WordPress plugins & themes · reported by MITREMedium 5.4
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
Product
WP Google Maps
Fixed in
7.11.35
What to do
Update WP Google Maps to 7.11.35 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
May 13, 2019Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameCVE-2018-16139 · Other software · Bibliosoft · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/.
Product
Bibliopac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0x90.zone 0x90.zone
Oct 3, 2018An issue was discovered in OPAC EasyWeb Five 5.7.CVE-2018-17428 · Other software · Nexusfi · reported by MITRECritical 9.8
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter.
Product
Opac Easyweb Five
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 6, 2018yyooopack is a simple file server.CVE-2017-16167 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Product
yyooopack node module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nodesecurity.io
Jul 21, 2017Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remoCVE-2015-4639 · Other software · Koha · reported by MITREHigh 8.8
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.
Product
Koha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.koha-community.org koha-community.org
May 3, 2016EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacitCVE-2016-0895 · Other software · EMC · reported by security_alert@emc.comMedium 4.3
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity.
Product
RSA Data Loss Prevention
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.