Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

110 results · page 1 of 3

Oct 10, 2026PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying aCVE-2026-108555 · Other software · schlagmichdoch · reported by VulnCheckLow 2.3
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
Product
PairDrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 8, 2026QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office emploCVE-2026-107702 · Other software · Webkul · reported by VulnCheckMedium 5.3
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.
Product
QloApps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 6, 2026QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-ofCVE-2026-105836 · Other software · Webkul · reported by VulnCheckMedium 5.3
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.
Product
QloApps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Stored DOM-Based Cross-Site ScriptingCVE-2026-94376 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Generic SQL InjectionCVE-2026-93899 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Authorization bypassCVE-2026-89334 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Information Exposure by SpoofingCVE-2026-89093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 16, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Reflected Cross-Site ScriptingCVE-2026-18555 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.22
What to do
Affects up to 2.15.22. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access codeCVE-2026-77010 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not have any authorisation or authentication checkCVE-2026-77008 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026HEL Online Classroom: AI-powered Online Classrooms: Does not perform any authorisation check on one of its REST API routesCVE-2026-77007 · WordPress plugins & themes · reported by WPScanHigh 7.5
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms.CVE-2026-46688 · Other software · meeting-room-booking-system · reported by GitHubMedium 6.9
The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available.
Product
mrbs-code
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 12, 2026The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms.CVE-2026-46382 · Other software · meeting-room-booking-system · reported by GitHubHigh 8.7
The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available.
Product
mrbs-code
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Arbitrary file deletionCVE-2026-16585 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.19
What to do
Affects up to 2.15.19. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local accCVE-2026-53409 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8
Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Jun 25, 2026Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.CVE-2026-13350 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.3
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
Product
Venueless
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created.CVE-2026-34030 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.9
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile pictures, and settings. An authenticated attacker with the settings_branches_manage privilege can include path traversal sequences in the branch code and influence the final filesystem location used by affected file operations. This can allow files to be stored in unintended locations, subject to service-account write permissions and branch-code length restrictions.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll comCVE-2026-34029 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.8
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key can be used to decrypt the licence.whs file, which contains sensitive information about the licensing party and a second key that can be used to decrypt other configuration files.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme.CVE-2026-34028 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.9
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomCVE-2026-34027 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.3
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservicCVE-2026-34026 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.1
Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation, allowing an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application. This includes, but is not limited to, application log files containing sensitive information and application binaries.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process.CVE-2026-34025 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.3
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application restricts user logins based on the IP address associated with a branch location, but the client IP address is derived from the HTTP X-Forwarded-For header when that header is present. An attacker with valid branch user credentials can manipulate the X-Forwarded-For header during login to spoof the expected branch IP address and obtain a valid authenticated session from an unauthorized network location.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints.CVE-2026-34024 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.6
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable. This allows the attacker to perform restricted actions such as switching the user's branch, uploading arbitrary files, downloading arbitrary files, and viewing details of arbitrary branches.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by CVE-2026-34023 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.1
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.
Product
Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptogrCVE-2026-34022 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.1
The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt the data traffic. During reassessment, it was possible to break the encryption/decryption routine and decrypt messages without knowledge of the encryption key. It was also possible to gain knowledge about the encryption key by intercepting enough messages.
Product
Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
Jun 15, 2026The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller withouCVE-2026-34021 · Other software · Wertheim GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.6
The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path between the server and the microcontroller can sniff RS-485 messages and replay previously observed messages. This can be used, for example, to spoof a "quit alarm" message and continuously deactivate the safe alarm.
Product
Wertheim SafeController 5400 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com wertheim-safes.com
May 13, 2026Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via CVE-2026-30906 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
May 12, 2026HEL Online Classroom: AI-powered Online Classrooms: Missing AuthorizationCVE-2026-6708 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission_callback of '__return_true', which bypasses all WordPress authentication and authorization checks. This makes it possible for unauthenticated attackers to delete any classroom record by supplying its ID in the request, resulting in permanent data loss.
Product
HEL Online Classroom: AI-powered Online Classrooms
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update HEL Online Classroom: AI-powered Online Classrooms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2026Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-25528 · Other software · Inoutscripts · reported by VulnCheckHigh 8.8
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the property1 parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to extract sensitive data or modify database contents.
Product
Inout EasyRooms Ultimate Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Mar 12, 2026Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-25527 · Other software · Inoutscripts · reported by VulnCheckHigh 8.8
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the numguest parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to bypass authentication, extract sensitive data, or modify database contents.
Product
Inout EasyRooms Ultimate Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Mar 12, 2026Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-25526 · Other software · Inoutscripts · reported by VulnCheckHigh 8.8
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the location parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads in the location field to extract sensitive data or modify database contents.
Product
Inout EasyRooms Ultimate Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Mar 12, 2026Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-25525 · Other software · Inoutscripts · reported by VulnCheckHigh 8.8
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the guests parameter. Attackers can send POST requests to the search/rentals endpoint with malicious SQL payloads to bypass authentication, extract sensitive data, or modify database contents.
Product
Inout EasyRooms Ultimate Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Mar 11, 2026Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local aCVE-2026-30901 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7
Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Feb 4, 2026NavigaTUM is a website and API to search for rooms, buildings and other places.CVE-2026-25575 · Other software · TUM-Dev · reported by GitHubHigh 8.8
NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7.
Product
NavigaTUM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 10, 2025External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via loCVE-2025-67461 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5
External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Dec 10, 2025Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilegCVE-2025-67460 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.8
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Oct 16, 2025ChatLuck contains a cross-site scripting vulnerability in Chat Rooms.CVE-2025-53858 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
Product
ChatLuck
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp chatluck.com
Oct 15, 2025Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network accesCVE-2025-58133 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5.3
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
Product
Zoom Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Apr 15, 2025An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-31654 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-27565 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-27561 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename "rooms" of arbitrary users.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-27938 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Nov 19, 2024Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.CVE-2024-45422 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
Product
Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Nov 19, 2024Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.CVE-2024-45420 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Nov 19, 2024Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2024-45419 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Product
Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Oct 28, 2024The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameterCVE-2024-48465 · Other software · mrbs · reported by MITRECritical 9.8
The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter
Product
mrbs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mrbs.sourceforge.io
Aug 14, 2024Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.CVE-2024-42441 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
Product
Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Aug 14, 2024Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5CVE-2024-42440 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.2
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
Product
Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42438 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Aug 14, 2024Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netwoCVE-2024-42437 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.5
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Product
Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.