Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Aug 21, 2026NewPath WildApricotPress Add-on: Does not enforce its members-only field privacy on an unauthenticated REST routeCVE-2026-13736 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
- Product
- NewPath WildApricotPress Add-on
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update NewPath WildApricotPress Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 6, 2026Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component.CVE-2026-49086 · Email & office · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from('dapr-pubsub:p:t').to('dapr-pubsub:p:other')), an actor able to publish a message to the subscribed topic could set the CloudEvent's pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route's intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the top
- Product
- Apache Camel Dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orgopenwall.com
Jul 2, 2026Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacCVE-2026-59096 · Other software · dapr · reported by VulnCheckHigh 8.2
Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery document so relying parties performing dynamic (unpinned) discovery fetch the JWKS from an attacker-controlled server, causing attacker-signed JWTs to be accepted. Exploitation requires the OIDC server enabled without a configured jwt-issuer or oidc-allowed-hosts.
- Product
- dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class.CVE-2026-49268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
- Product
- Apache Shiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 8, 2026Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.CVE-2026-41491 · Other software · dapr · reported by GitHubHigh 8.1
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path while the target application received a different one. This issue has been patched in versions 1.15.14, 1.16.14, and 1.17.5.
- Product
- dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024AgendaPress – Easily Publish Meeting Agendas and Programs on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Black and White AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress allows Stored XSS.This issue affects AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress: from n/a through <= 1.0.8.
- Product
- AgendaPress – Easily Publish Meeting Agendas and Programs on
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update AgendaPress – Easily Publish Meeting Agendas and Programs on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.CVE-2024-35223 · Other software · dapr · reported by GitHubMedium 5.3
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.
- Product
- dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write orCVE-2024-3746 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govMedium 6.8
The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files.
- Product
- ScadaPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge.CVE-2023-37918 · Other software · dapr · reported by GitHubMedium 6.8
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.
- Product
- dapr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.dapr.iogithub.com
Oct 3, 2022Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.CVE-2022-38817 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
- Product
- Dapr Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modifCVE-2022-3263 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
- Product
- ScadaPro Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.CVE-2022-2898 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govMedium 6.1
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
- Product
- ScadaPro Server and Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..CVE-2022-2897 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..
- Product
- ScadaPro Server and Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.CVE-2022-2896 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.
- Product
- ScadaPro Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls.CVE-2022-2895 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file.
- Product
- ScadaPro Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls.CVE-2022-2894 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.
- Product
- ScadaPro Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing CVE-2022-2892 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file.
- Product
- ScadaPro Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2021An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset.CVE-2021-22545 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comHigh 7.5
An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7
- Product
- Bindiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzynamics.comzynamics.com
May 25, 2012Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a TroCVE-2012-1824 · Other software · Measuresoft · reported by cret@cert.orgHigh 7.2
Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
- Product
- Scadapro Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmeasuresoft.netmeasuresoft.net
Sep 16, 2011service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insCVE-2011-3497 · Other software · Measuresoft · reported by MITREHigh 10
service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
- Product
- Scadapro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecurityreason.com
Sep 16, 2011service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) BF, (2) OF, or (CVE-2011-3496 · Other software · Measuresoft · reported by MITREHigh 10
service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) BF, (2) OF, or (3) EF command.
- Product
- Scadapro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecurityreason.com
Sep 16, 2011Multiple directory traversal vulnerabilities in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to read, modify, or delete arbitrarCVE-2011-3495 · Other software · Measuresoft · reported by MITREHigh 10
Multiple directory traversal vulnerabilities in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to read, modify, or delete arbitrary files via the (1) RF, (2) wF, (3) UF, or (4) NF command.
- Product
- Scadapro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecurityreason.com
Sep 16, 2011Multiple stack-based buffer overflows in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to cause a denial of service (crash) and pCVE-2011-3490 · Other software · Measuresoft · reported by MITREHigh 10
Multiple stack-based buffer overflows in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long command to port 11234, as demonstrated with the TF command.
- Product
- Scadapro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsecurityreason.com
Jan 2, 2003OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications thatCVE-2002-1379 · Other software · Openldap · reported by MITREHigh 7.5
OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.
- Product
- Openldap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgmandriva.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.