Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Dec 29, 2025Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.CVE-2025-69235 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.CVE-2025-69234 · Other software · NAVER · reported by cve@navercorp.comCritical 9.1
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.CVE-2025-62585 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-62584 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.CVE-2025-62583 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-53600 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.CVE-2025-53599 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings.CVE-2024-50583 · Other software · NAVER · reported by cve@navercorp.comMedium 6.3
Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings.
- Product
- Naver Whale browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.CVE-2024-40618 · Other software · NAVER · reported by cve@navercorp.comCritical 9.6
Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Nov 27, 2023The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.CVE-2023-25632 · Other software · NAVER · reported by cve@navercorp.comMedium 5.5
The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jun 26, 2022NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.CVE-2020-9754 · Other software · NAVER · reported by cve@navercorp.comMedium 5.3
NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files.CVE-2022-24075 · Other software · NAVER · reported by cve@navercorp.comMedium 6.5
Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could leadCVE-2022-24074 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.CVE-2022-24073 · Other software · NAVER · reported by cve@navercorp.comHigh 7.1
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Mar 17, 2022The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.CVE-2022-24072 · Other software · NAVER · reported by cve@navercorp.comMedium 6.1
The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jan 28, 2022A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal ACVE-2022-24071 · Other software · NAVER · reported by cve@navercorp.comMedium 4.3
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Nov 2, 2021Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar CVE-2021-33593 · Other software · NAVER · reported by cve@navercorp.comMedium 5.3
Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
May 19, 2020Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.CVE-2020-9753 · Other software · NAVER Corporation · reported by cve@navercorp.comCritical 9.1
Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.
- Product
- Whale Browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Oct 11, 2018The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.CVE-2018-12449 · Other software · NAVER Corporation · reported by cve@navercorp.comHigh 7.8
The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.
- Product
- Whale Browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Aug 2, 2018Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allowCVE-2018-12448 · Other software · NAVER Corporation · reported by cve@navercorp.comMedium 5.3
Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.
- Product
- Whale Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jul 3, 2018Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows aCVE-2018-7635 · Other software · Navercorp · reported by MITREMedium 5.3
Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
- Product
- Whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.