Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

50 results

Oct 22, 2026webpack-dev-server is a development server that provides live reloading for webpack projects.CVE-2026-114348 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing the full exception stack trace, which discloses absolute filesystem paths, installed module locations, and internal source line numbers. The server keeps running, so there is no denial of service. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, and users should upgrade to one of those versions or later.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Oct 22, 2026webpack-dev-server is a development server that provides live reloading for webpack projects.CVE-2026-112085 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 8.2
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where proxied WebSocket upgrades pass the same Host and Origin validation as the HMR WebSocket, and users should upgrade to one of those versions or later. As a workaround, omit WebSocket forwarding from proxy entries that do not need it and scope the proxy to specific paths.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Jul 3, 2026webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformCVE-2026-14631 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Jul 3, 2026webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that CVE-2026-14620 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 4.7
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Jun 15, 2026Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.CVE-2026-9595 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Jun 3, 2026A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.CVE-2026-35085 · Other software · MBS · reported by info@cert.vde.comHigh 8.7
A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.
Product
Single-A
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com
May 12, 2026webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy originCVE-2026-6402 · Other software · webpack-dev-server · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.3
webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Jun 3, 2025webpack-dev-server allows users to use webpack with a development server that provides live reloading.CVE-2025-30360 · Other software · webpack · reported by GitHubMedium 6.5
webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 3, 2025webpack-dev-server allows users to use webpack with a development server that provides live reloading.CVE-2025-30359 · Other software · webpack · reported by GitHubMedium 5.3
webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.
Product
webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 27, 2024There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier).CVE-2024-38658 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Nov 15, 2023Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.CVE-2023-47586 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hakko-elec.co.jp jvn.jp
Nov 15, 2023Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.CVE-2023-47585 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hakko-elec.co.jp jvn.jp
Nov 15, 2023Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.CVE-2023-47584 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hakko-elec.co.jp jvn.jp
Jun 19, 2023Stack-based buffer overflow vulnerability in V-Server v4.0.15.0 and V-Server Lite v4.0.15.0 and earlier allows an attacker to execute arbitrary code by having uCVE-2023-31239 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Stack-based buffer overflow vulnerability in V-Server v4.0.15.0 and V-Server Lite v4.0.15.0 and earlier allows an attacker to execute arbitrary code by having user open a specially crafted VPR file.
Product
V-Server and V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Jan 2, 2023Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by hCVE-2022-47908 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Jan 2, 2023Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a CVE-2022-47317 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Jan 2, 2023Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a uCVE-2022-41645 · Other software · FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Dec 21, 2022All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url userCVE-2022-25895 · Other software · Lite-dev-server Project · reported by report@snyk.ioHigh 7.5
All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
Product
Lite-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Nov 29, 2022This affects all versions of package static-dev-server.CVE-2022-25848 · Other software · Static-dev-server Project · reported by report@snyk.ioHigh 7.5
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.
Product
Static-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com security.snyk.io
Jun 15, 2022Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain informaCVE-2022-30549 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Product
V-Server and V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Jun 14, 2022Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain informCVE-2022-29524 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Product
V-Server and V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitiveCVE-2021-38421 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitive information from other memory locations or cause a crash.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a systeCVE-2021-38419 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project fCVE-2021-38415 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achievCVE-2021-38413 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achieve code execution.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may allow an attacker readCVE-2021-38409 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may allow an attacker read from or write to unexpected memory locations, leading to a denial-of-service.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Dec 20, 2021Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to exeCVE-2021-38401 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to execute arbitrary code and cause the application to crash.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Oct 7, 2021The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.CVE-2021-40978 · Other software · Mkdocs · reported by MITREHigh 7.5
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
Product
Mkdocs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2021The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arCVE-2020-25171 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jan 27, 2021Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project fileCVE-2021-22655 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jan 27, 2021Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project filCVE-2021-22653 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Jan 27, 2021A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file CVE-2021-22641 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Jan 27, 2021An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file thatCVE-2021-22639 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Jan 27, 2021Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to craft a special proCVE-2021-22637 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov zerodayinitiative.com
Jul 25, 2020This affects all versions of package rollup-plugin-dev-server.CVE-2020-7686 · Other software · Rollup-plugin-dev-server Project · reported by report@snyk.ioHigh 7.5
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Product
Rollup-plugin-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record snyk.io snyk.io
Apr 13, 2020Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow.CVE-2020-10646 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.8
Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when parsing VPR files, is too small.
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Nov 13, 2019In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary cCVE-2019-18240 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govCritical 9.8
In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code.
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Jun 12, 2019Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext.CVE-2019-3947 · Other software · Fujielectric · reported by vulnreport@tenable.comCritical 9.8
Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tenable.com
Jun 12, 2019Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005.CVE-2019-3946 · Other software · Fujielectric · reported by vulnreport@tenable.comHigh 7.5
Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated, remote attacker can crash vserver.exe due to an integer overflow in the UDP message handling logic.
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tenable.com
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution.CVE-2018-14823 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution.CVE-2018-14819 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.CVE-2018-14817 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code execution.CVE-2018-14815 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code execution.
Product
V-server Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code execution.CVE-2018-14813 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remote code execution.CVE-2018-14811 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Sep 26, 2018Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.CVE-2018-14809 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govCritical 9.8
Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.
Product
V-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Sep 21, 2018An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.CVE-2018-14732 · Other software · Webpack.js · reported by MITREHigh 7.5
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
Product
Webpack-dev-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.cal1.cn github.com
Sep 13, 2018A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite CVE-2018-10637 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 7.8
A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite 4.0.3.0 and prior.
Product
V-Server Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 5, 2018A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior.CVE-2018-5442 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govCritical 9.8
A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution.
Product
V-server VPR Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Jul 17, 2017An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior.CVE-2017-9639 · Other software · Fujielectric · reported by ics-cert@hq.dhs.govHigh 7.3
An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. A memory corruption vulnerability has been identified (aka improper restriction of operations within the bounds of a memory buffer), which may allow remote code execution.
Product
V-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.