Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Sep 15, 2026moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.CVE-2026-17495 · Other software · moment · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
- Product
- moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from useCVE-2026-80886 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and over again. This is most likely to happen during system startup or shutdown when the init system starts/stops a large number of system services that interact with various kernel code. When userspace writes to the TTY device, the driver initiates an asynchronous DMA transfer and releases the port lock. At the same moment, the kernel printk path might grab the port lock and re-configure the UART controller for PIO, without waiting for the DMA operation to complete. It seems like this collision results in zero progress being reported for the DMA engine, so the same text is printed to the console over and over again. For the kernel console, we want a reliable output path that will be functional even during crashes etc. So rather than implementing complex code to synchronize the kernel console write routines with the userspace DMA write routines, simply disable DMA for the console UART instanc
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 2, 2026DeMomentSomTres Shortcodes: Stored Cross-Site ScriptingCVE-2026-8885 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes within the st_callout() function, which concatenates the attribute values directly into an HTML style attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- DeMomentSomTres Shortcodes
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update DeMomentSomTres Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026Moments: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25458 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2.
- Product
- Moments
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Moments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2026Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTPCVE-2019-25333 · Other software · Bullwark · reported by VulnCheckHigh 8.7
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP request paths. Attackers can exploit the vulnerability by sending crafted GET requests with multiple '../' sequences to read sensitive files like /etc/passwd outside the web root directory.
- Product
- Momentum Series JAWS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Aug 21, 2025eslint-ban-moment is an Eslint plugin for final assignment in VIHU.CVE-2025-57754 · Other software · kristoferfannar · reported by GitHubCritical 9.8
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
- Product
- eslint-ban-moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation.CVE-2024-9400 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 14, 2024CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase.CVE-2024-34354 · Other software · CriticalMoments · reported by GitHubMedium 6.5
CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.
- Product
- CMSaasStarter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024DeMomentSomTres WordPress Export Posts With Images: Does not check authorization of requests to export the blog dataCVE-2023-5905 · WordPress plugins & themes · reported by WPScanHigh 8.1
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
- Product
- DeMomentSomTres WordPress Export Posts With Images
- Affected
- up to 20220825
- What to do
- Affects up to 20220825. Update DeMomentSomTres WordPress Export Posts With Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2023Luxon is a library for working with dates and times in JavaScript.CVE-2023-22467 · Other software · moment · reported by GitHubHigh 7.5
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
- Product
- luxon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privilegeCVE-2022-38069 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 4.3
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device funCVE-2022-36385 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 6.8
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.CVE-2022-31129 · Other software · moment · reported by GitHubHigh 7.5
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
- Product
- moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.CVE-2022-24785 · Other software · moment · reported by GitHubHigh 7.5
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
- Product
- moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX MomentCVE-2021-32025 · Other software · BlackBerry · reported by secure@blackberry.comHigh 8.1
An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system.
- Product
- QNX Software Development Platform (SDP), QNX OS for Medical (QOSM), and QNX OS for Safety (QOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.comsupport.blackberry.com
Jun 30, 2019Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary CVE-2019-11826 · Network & remote access · Synology · reported by security@synology.comHigh 8
Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter.
- Product
- Photo Moments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Apr 1, 2019Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbiCVE-2018-13298 · Network & remote access · Synology · reported by security@synology.comMedium 4.2
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
- Product
- Android Moments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jul 9, 2018The mintToken function of a smart contract implementation for MomentumToken, an Ethereum token, has an integer overflow that allows the owner of the contract toCVE-2018-13628 · Other software · Momentumprotocol · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for MomentumToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Momentumtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12323 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console.
- Product
- Momentum Axel 720p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12261 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12260 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.7
An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12259 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system compromise.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12258 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12257 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2018Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.CVE-2018-10328 · Other software · Momentum · reported by MITREHigh 7.4
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2018The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-201CVE-2017-18214 · Other software · Momentjs · reported by MITREHigh 7.5
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
- Product
- Moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Mar 14, 2017Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via execuCVE-2015-8993 · Other software · Intel · reported by secure@intel.comHigh 7
Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
- Product
- CloudAV (Beta)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservice.mcafee.comservice.mcafee.com
Mar 14, 2017Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable viCVE-2015-8992 · Other software · Intel · reported by secure@intel.comHigh 7
Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
- Product
- WebAdvisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservice.mcafee.comservice.mcafee.com
Mar 14, 2017Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulneraCVE-2015-8991 · Other software · Intel · reported by secure@intel.comHigh 7
Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
- Product
- McAfee Security Scan+ (MSS+)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservice.mcafee.comservice.mcafee.com
Jan 23, 2017The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, CVE-2016-4055 · Other software · Momentjs · reported by MITREMedium 6.5
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
- Product
- Moment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comoracle.com
Jul 12, 2013Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 CVE-2013-2687 · Other software · Blackberry · reported by MITREHigh 7.8
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.
- Product
- QNX Momentics Tool Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgics-cert.us-cert.gov
Jul 7, 2008Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.CVE-2008-3024 · Other software · Blackberry · reported by MITREHigh 9.3
Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.
- Product
- QNX Momentics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.