Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Mar 4, 2026A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.CVE-2025-69969 · Other software · Pebblepower · reported by MITRECritical 9.6
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity (Adjacent), requiring no physical contact with the device. Furthermore, the vulnerability is not limited to arbitrary commands but includes cleartext data interception and unauthenticated firmware hijacking via OTA services.
- Product
- Pebble Prism Ultra Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag.CVE-2025-1686 · Other software · Pebbletemplates · reported by report@snyk.ioMedium 4.8
Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ. Workaround This vulnerability can be mitigated by disabling the include macro in Pebble Templates: java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build();
- Product
- Pebble Templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2024A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files.CVE-2024-11858 · Other software · Radare · reported by patrick@puiterwijk.orgHigh 8.6
A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024Glossarizer through 1.5.2 improperly tries to convert text into HTML.CVE-2024-42515 · Other software · pebbleroad · reported by MITRECritical 9.9
Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.
- Product
- glossarizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comherolab.usd.de
Apr 4, 2024It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local usersCVE-2024-3250 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 6.5
It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.CVE-2022-37767 · Other software · Pebbletemplates · reported by MITRECritical 9.8
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Product
- Pebble Templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical seCVE-2021-38546 · Other software · Creative · reported by MITREMedium 5.9
CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
- Product
- Pebble V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnassiben.comnassiben.com
Dec 18, 2019Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessibCVE-2019-19899 · Other software · Pebbletemplates · reported by MITRECritical 9.8
Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.
- Product
- Pebble Templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2017Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary aCVE-2016-10702 · Other software · Pebble · reported by MITREMedium 6.1
Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary.
- Product
- Pebble Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.fletchto99.comblog.fletchto99.com
Nov 8, 2012CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unsCVE-2012-4023 · Other software · Simon Brown · reported by vultures@jpcert.or.jpMedium 4.3
CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2012Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.CVE-2012-4022 · Other software · Simon Brown · reported by vultures@jpcert.or.jpMedium 6.4
Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2012Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecifiedCVE-2012-5170 · Other software · Simon Brown · reported by vultures@jpcert.or.jpMedium 5.8
Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2009Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2009-0736 · Other software · Simon Brown · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsourceforge.net
Oct 10, 2006Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown Pebble 2.0.0 RC1 and RC2 allows remote attackers to inject arbitrary web scrCVE-2006-5168 · Other software · Simon Brown · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown Pebble 2.0.0 RC1 and RC2 allows remote attackers to inject arbitrary web script or HTML via the query string.
- Product
- Pebble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsvn.sourceforge.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.