Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
35 results
Oct 13, 2026A flaw has been found in PaddlePaddle PaddleX up to 3.7.2.CVE-2026-108961 · Other software · PaddlePaddle · reported by VulDBMedium 5.3
A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance.
- Product
- PaddleX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1.CVE-2026-10800 · Other software · PaddlePaddle · reported by VulDBLow 2
A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue.
- Product
- FastDeploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2024paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.CVE-2024-1603 · Other software · paddlepaddle · reported by security@huntr.devHigh 7.5
paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6CVE-2024-0818 · Other software · paddlepaddle · reported by security@huntr.devCritical 9.1
Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024remote code execution in paddlepaddle/paddle 2.6.0CVE-2024-0917 · Other software · paddlepaddle · reported by security@huntr.devCritical 9.8
remote code execution in paddlepaddle/paddle 2.6.0
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0CVE-2024-0815 · Other software · paddlepaddle · reported by security@huntr.devHigh 8.8
Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0CVE-2024-0817 · Other software · paddlepaddle · reported by security@huntr.devHigh 7.8
Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2024Code Injection in paddlepaddle/paddleCVE-2024-0521 · Other software · paddlepaddle · reported by security@huntr.devHigh 7.8
Code Injection in paddlepaddle/paddle
- Product
- paddlepaddle/paddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare.CVE-2023-52314 · Other software · PaddlePaddle · reported by paddle-security@baidu.comCritical 9.6
PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0.CVE-2023-52313 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0.CVE-2023-52312 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024PaddlePaddle before 2.6.0 has a command injection in _wget_download.CVE-2023-52311 · Other software · PaddlePaddle · reported by paddle-security@baidu.comCritical 9.6
PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval.CVE-2023-52310 · Other software · PaddlePaddle · reported by paddle-security@baidu.comCritical 9.6
PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0.CVE-2023-52309 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 8.2
Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.amin in PaddlePaddle before 2.6.0.CVE-2023-52308 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.amin in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0.CVE-2023-52307 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 8.2
Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.lerp in PaddlePaddle before 2.6.0.CVE-2023-52306 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.topk in PaddlePaddle before 2.6.0.CVE-2023-52305 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.topk in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0.CVE-2023-52304 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 8.2
Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0. This flaw can lead to a denial of service, or even more damage.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0.CVE-2023-52303 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0.CVE-2023-52302 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024OOB access in paddle.mode in PaddlePaddle before 2.6.0.CVE-2023-38678 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
OOB access in paddle.mode in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0.CVE-2023-38677 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Nullptr in paddle.dot in PaddlePaddle before 2.6.0.CVE-2023-38676 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
Nullptr in paddle.dot in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0.CVE-2023-38675 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024FPE in paddle.nanmedian in PaddlePaddle before 2.6.0.CVE-2023-38674 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023PaddlePaddle before 2.5.0 has a command injection in fs.py.CVE-2023-38673 · Other software · PaddlePaddle · reported by paddle-security@baidu.comCritical 9.6
PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023FPE in paddle.trace in PaddlePaddle before 2.5.0.CVE-2023-38672 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0.CVE-2023-38671 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 8.3
Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0.CVE-2023-38670 · Other software · PaddlePaddle · reported by paddle-security@baidu.comMedium 4.7
Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.CVE-2023-38669 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 8.3
Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.CVE-2022-46742 · Other software · PaddlePaddle · reported by paddle-security@baidu.comCritical 10
Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.CVE-2022-46741 · Other software · PaddlePaddle · reported by paddle-security@baidu.comHigh 7.1
Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.
- Product
- PaddlePaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr.CVE-2022-45908 · Other software · Paddlepaddle · reported by MITRECritical 9.8
In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.
- Product
- Paddlepaddle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31523 · Other software · Paddlepaddle · reported by MITRECritical 9.3
The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Anakin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.