Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 16, 2026Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.CVE-2026-59969 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 13, 2026PyQuorum is a cryptographic library for secret sharing and key management.CVE-2026-44368 · Other software · svvqt · reported by GitHubMedium 6.9
PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.
- Product
- pyquorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login pCVE-2024-44449 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login page.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordquorum.comseclists.org
Jul 25, 2021In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/..CVE-2021-37447 · Other software · Nchsoftware · reported by MITREHigh 8.1
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/..CVE-2021-37446 · Other software · Nchsoftware · reported by MITREMedium 4.3
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/..CVE-2021-37445 · Other software · Nchsoftware · reported by MITREMedium 6.5
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).CVE-2021-37467 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).CVE-2021-37466 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).CVE-2021-37465 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).CVE-2021-37464 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).CVE-2021-37463 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.CVE-2021-37452 · Other software · NCH · reported by MITREMedium 5.5
NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of TCVE-2021-23005 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.1
On all 7.x and 6.x versions (fixed in 8.0.0), when using a Quorum device for BIG-IQ high availability (HA) for automatic failover, BIG-IQ does not make use of Transport Layer Security (TLS) with the Corosync protocol. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of autCVE-2021-22995 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of authentication with the Corosync daemon. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 21, 2018No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta.CVE-2018-8012 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.