Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Sep 22, 2026Novu provides an API for sending notifications through multiple channels.CVE-2026-75517 · Other software · novuhq · reported by GitHubMedium 6.5
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.
- Product
- novu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Novu provides an API for sending notifications through multiple channels.CVE-2026-75511 · Other software · novuhq · reported by GitHubMedium 5.3
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.
- Product
- novu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Novu provides an API for sending notifications through multiple channels.CVE-2026-75510 · Other software · novuhq · reported by GitHubMedium 5.1
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.
- Product
- novu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials viaCVE-2023-24215 · Other software · reported by MITRECritical 9.1
Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly.CVE-2026-40572 · Other software · MinecAnton209 · reported by GitHubCritical 9
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24.
- Product
- NovumOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly.CVE-2026-40317 · Other software · MinecAnton209 · reported by GitHubCritical 9.3
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user-mode process to jump to kernel addresses and execute arbitrary code in Ring 0 context, resulting in local privilege escalation. This issue has been fixed in version 0.24. If developers are unable to immediately update, they should restrict syscall access by running the system in single-user mode without Ring 3, and disable user-mode processes by only running kernel shell with no user processes. This issue has been fixed in version 0.24.
- Product
- NovumOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users wCVE-2021-3262 · Other software · Trispark · reported by MITRECritical 9.8
TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.
- Product
- Novusedu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Novu provides an API for sending notifications through multiple channels.CVE-2023-35948 · Other software · novuhq · reported by GitHubMedium 5.4
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
- Product
- novu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.CVE-2023-3520 · Other software · it-novum · reported by security@huntr.devMedium 4.6
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
- Product
- it-novum/openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2023it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.CVE-2023-36663 · Other software · It-novum · reported by MITREHigh 8.8
it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenitcockpit.io
Jun 13, 2023Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.CVE-2023-3218 · Other software · it-novum · reported by security@huntr.devMedium 4.4
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
- Product
- it-novum/openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2021Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2.CVE-2021-34821 · Other software · AAT · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags.
- Product
- Novus Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jul 19, 2021Web Path Directory Traversal in the Novus HTTP Server.CVE-2021-34820 · Other software · AAT · reported by MITREHigh 7.5
Web Path Directory Traversal in the Novus HTTP Server. The Novus HTTP Server is affected by the Directory Traversal for Arbitrary File Access vulnerability. A remote, unauthenticated attacker using an HTTP GET request may be able to exploit this issue to access sensitive data. The issue was discovered in the NMS (Novus Management System) software through 1.51.2
- Product
- Novus Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 25, 2020openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.CVE-2020-10788 · Other software · It-novum · reported by MITRECritical 9.1
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenitcockpit.io
Mar 25, 2020app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP rCVE-2020-10791 · Other software · It-novum · reported by MITREMedium 6.5
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenitcockpit.io
Mar 25, 2020openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.CVE-2020-10790 · Other software · It-novum · reported by MITREMedium 5.4
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2020openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an suCVE-2020-10789 · Other software · It-novum · reported by MITRECritical 9.8
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenitcockpit.io
Mar 20, 2020openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staginCVE-2020-10792 · Other software · It-novum · reported by MITREHigh 7.5
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenitcockpit.io
Dec 31, 2019openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-10227 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenitcockpit.ioopenitcockpit.io
Oct 30, 2019Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remoteCVE-2013-1391 · Other software · Huntcctv · reported by MITREHigh 7.5
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
- Product
- Dvr-04ch Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritybydefault.comrapid7.com
Aug 23, 2019openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.CVE-2019-15494 · Other software · It-novum · reported by MITRECritical 9.8
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.CVE-2019-15493 · Other software · It-novum · reported by MITREHigh 7.5
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.CVE-2019-15492 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.CVE-2019-15491 · Other software · It-novum · reported by MITREHigh 8.8
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.CVE-2019-15490 · Other software · It-novum · reported by MITRECritical 9.8
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2015The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate CVE-2015-5372 · Other software · Adnovum · reported by MITREMedium 5
The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.
- Product
- Nevisauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csnc.chpacketstormsecurity.com
Sep 28, 2007Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.CVE-2007-5142 · Other software · Solidweb · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Novus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Sep 27, 2007SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota_id parameter.CVE-2007-5123 · Other software · Solidweb · reported by MITREHigh 7.5
SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota_id parameter.
- Product
- Novus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.