Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possibleCVE-2026-100275 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameCVE-2019-25577 · Websites & servers · Seotoaster · reported by VulnCheckMedium 6.8
SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal sequences in the getcss or getjs parameters to retrieve file contents.
- Product
- SeoToaster Ecommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comseotoaster.com
Dec 15, 2025LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is CVE-2025-14020 · Other software · LINE Corporation · reported by dl_cve@linecorp.comMedium 5.4
LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.
- Product
- LINE client for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing.CVE-2025-13132 · Other software · The Browser Company of New York · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)
- Product
- Dia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Toast Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.
- Product
- Toast Mobile Menu
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Toast Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024RSVPMaker for Toastmasters: Unrestricted Upload of File with Dangerous TypeCVE-2024-50531 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.
- Product
- RSVPMaker for Toastmasters
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update RSVPMaker for Toastmasters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2024In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed.CVE-2024-23708 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Dec 19, 2023Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox.CVE-2023-6870 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox < 121.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Feb 21, 2023A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4.CVE-2021-4325 · Other software · NHN · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in NHN TOAST UI Chart 4.1.4. This issue affects some unknown processing of the component Legend Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 4.2.0 is able to address this issue. The identifier of the patch is 1a3f455d17df379e11b501bb5ba1dd1bcc41d63e. It is recommended to upgrade the affected component. The identifier VDB-221501 was assigned to this vulnerability.
- Product
- TOAST UI Chart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messagCVE-2022-43720 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 8, 2022Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the aCVE-2022-39900 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 22, 2022Toast UI Grid is a component to display and edit data.CVE-2022-23458 · Other software · nhn · reported by GitHubMedium 6.1
Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds.
- Product
- tui.grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Jun 7, 2022Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message informaCVE-2022-30716 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 13, 2021The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast.CVE-2021-29438 · Other software · nextcloud · reported by GitHubMedium 4.6
The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.
- Product
- nextcloud-dialogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2020It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable.CVE-2020-0014 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 8, 2019In Materialize through 1.0.0, XSS is possible via the Toast feature.CVE-2019-11004 · Other software · Materializecss · reported by MITREMedium 6.1
In Materialize through 1.0.0, XSS is possible via the Toast feature.
- Product
- Materialize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.CVE-2018-11650 · Other software · Graylog · reported by MITREMedium 6.1
Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
- Product
- Graylog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitraryCVE-2018-8921 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name.
- Product
- Drive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jan 19, 2013Directory traversal vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to read or CVE-2012-5185 · Other software · Olivetoast · reported by vultures@jpcert.or.jpHigh 7.5
Directory traversal vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to read or delete files by leveraging guest access.
- Product
- Documents Pro File Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2013Cross-site scripting (XSS) vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to iCVE-2012-5184 · Other software · Olivetoast · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Documents Pro File Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2012Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlieCVE-2011-5230 · Other software · Seotoaster · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member.
- Product
- Seotoaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2006Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary cCVE-2006-4866 · Computers, phones & browsers · Apple · reported by MITREMedium 4.6
Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via a long extension argument.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uknetragard.com
Sep 14, 2006Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via temporary files, inclCVE-2006-4801 · Other software · Roxio · reported by MITREMedium 6.2
Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via temporary files, including dejavu_manual.rb, which are executed with raised privileges.
- Product
- Toast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comnetragard.com
Mar 28, 2006Multiple cross-site scripting (XSS) vulnerabilities in toast.asp in Toast Forums 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML vCVE-2006-1414 · Other software · Toast Forums · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in toast.asp in Toast Forums 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) author, (2) subject, (3) message, or (4) dayprune parameter.
- Product
- Toast Forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpridels0.blogspot.comsecunia.com
Dec 31, 2004Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local useCVE-2004-1398 · Other software · Roxio · reported by MITREMedium 4.6
Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via format string specifiers in the extension argument.
- Product
- Toast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukmarc.info
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.