Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Apr 22, 2026An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0).CVE-2026-35548 · Other software · Guardsix · reported by MITREHigh 8.5
An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials.
- Product
- Logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordguardsix.comservicedesk.guardsix.com
Nov 27, 2025An issue was discovered in Logpoint before 7.7.0.CVE-2025-66361 · Other software · Logpoint · reported by MITREMedium 6.9
An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load.
- Product
- SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Nov 27, 2025An issue was discovered in Logpoint before 7.7.0.CVE-2025-66360 · Other software · Logpoint · reported by MITREMedium 6.9
An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) information to li-admin users. This can lead to privilege escalation.
- Product
- SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Nov 27, 2025An issue was discovered in Logpoint before 7.7.0.CVE-2025-66359 · Other software · Logpoint · reported by MITREHigh 8.5
An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability.
- Product
- SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Jul 20, 2025An issue was discovered in Logpoint before 7.6.0.CVE-2025-54317 · Other software · Logpoint · reported by MITREHigh 8.4
An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Template, which can lead to remote code execution (RCE).
- Product
- Logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
Jul 20, 2025An issue was discovered in Logpoint before 7.6.0.CVE-2025-54316 · Other software · Logpoint · reported by MITREMedium 4.9
An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks.
- Product
- Logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
Feb 14, 2025An issue was discovered in Logpoint AgentX before 1.5.0.CVE-2025-26789 · Other software · Logpoint · reported by MITREMedium 6.9
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment.
- Product
- AgentX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Dec 16, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-56087 · Other software · Logpoint · reported by MITREMedium 5.9
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading to Server-Side Template Injection.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Dec 16, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-56086 · Other software · Logpoint · reported by MITREHigh 7.1
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are executed when the backup process is initiated, leading to Remote Code Execution.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Dec 16, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-56085 · Other software · Logpoint · reported by MITREMedium 5.9
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Dec 16, 2024An issue was discovered in Logpoint UniversalNormalizer before 5.7.0.CVE-2024-56084 · Other software · Logpoint · reported by MITREHigh 7.1
An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while creating Universal Normalizer. These are executed, leading to Remote Code Execution.
- Product
- Universal Normalizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.com
Nov 7, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-48954 · Other software · logpoint · reported by MITREMedium 6.4
An issue was discovered in Logpoint before 7.5.0. Unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.logpoint.comservicedesk.logpoint.com
Nov 7, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-48953 · Other software · logpoint · reported by MITREHigh 7.5
An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication plugins in Logpoint, resulting in unauthorized access.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.logpoint.comservicedesk.logpoint.com
Nov 7, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-48952 · Other software · Logpoint · reported by MITREMedium 6.4
An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.
- Product
- Soar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.logpoint.comservicedesk.logpoint.com
Nov 7, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-48951 · Other software · logpoint · reported by MITREHigh 7.5
An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery (SSRF) on SOAR can be used to leak Logpoint's API Token leading to authentication bypass.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.logpoint.comservicedesk.logpoint.com
Nov 7, 2024An issue was discovered in Logpoint before 7.5.0.CVE-2024-48950 · Other software · logpoint · reported by MITREHigh 7.5
An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.logpoint.comservicedesk.logpoint.com
May 27, 2024An issue was discovered in Logpoint SAML Authentication before 6.0.3.CVE-2024-36383 · Other software · Logpoint · reported by MITREMedium 5.3
An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, and the file corresponding to this filename will ultimately be deleted. This can lead to a SAML Authentication login outage.
- Product
- Saml Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
May 7, 2024An issue was discovered in Logpoint before 7.4.0.CVE-2024-33860 · Other software · logpoint · reported by MITREMedium 6.5
An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlogpoint.comservicedesk.logpoint.com
May 7, 2024An issue was discovered in Logpoint before 7.4.0.CVE-2024-33859 · Other software · Logpoint · reported by MITREMedium 6.1
An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comlogpoint.com
May 7, 2024An issue was discovered in Logpoint before 7.4.0.CVE-2024-33858 · Other software · Logpoint · reported by MITREMedium 5.3
An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comlogpoint.com
May 7, 2024An issue was discovered in Logpoint before 7.4.0.CVE-2024-33857 · Other software · logpoint · reported by MITRECritical 9.6
An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
May 7, 2024An issue was discovered in Logpoint before 7.4.0.CVE-2024-33856 · Other software · logpoint · reported by MITREMedium 5.3
An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
May 1, 2024In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets.CVE-2024-30176 · Other software · logpoint · reported by MITREMedium 5.3
In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlogpoint.comservicedesk.logpoint.com
Apr 27, 2024An issue was discovered in Logpoint 7.1 before 7.1.2.CVE-2022-48685 · Other software · logpoint · reported by MITREHigh 7.7
An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leading to privilege escalation.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
Apr 27, 2024An issue was discovered in Logpoint before 7.1.1.CVE-2022-48684 · Other software · logpoint · reported by MITREHigh 8.4
An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating dynamic data. This could be abused to achieve code execution. Any user with access to create a search template can leverage this to execute code as the loginspect user.
- Product
- logpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
Mar 22, 2024Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.CVE-2024-29865 · Other software · Logpoint · reported by MITREMedium 5.4
Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicedesk.logpoint.comservicedesk.logpoint.com
Feb 3, 2024The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template inCVE-2023-49950 · Other software · Logpoint · reported by MITREMedium 5.4
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting (XSS) payload and send it to any system or device that sends logs to the SIEM. If an alert is created, the payload will execute upon the alert data being viewed with that template, which can lead to sensitive data disclosure.
- Product
- Siem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comservicedesk.logpoint.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.