Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Jul 16, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-45576 · Other software · openziti · reported by GitHubHigh 8.3
zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-45568 · Other software · openziti · reported by GitHubCritical 9.9
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in version 2.0.3.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained CVE-2026-58165 · Other software · openziti · reported by VulnCheckHigh 8.7
OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages.
- Product
- ziti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-42275 · Other software · openziti · reported by GitHubHigh 8.7
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-40304 · Other software · openziti · reported by GitHubMedium 5.3
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows the deletion to proceed without any ownership verification. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it. Version 2.0.1 patches the issue.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-40303 · Other software · openziti · reported by GitHubHigh 7.5
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026zrok is software for sharing web services, files, and network resources.CVE-2026-40302 · Other software · openziti · reported by GitHubMedium 6.1
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin. Version 2.0.1 patches the issue.
- Product
- zrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titleCVE-2023-53936 · Other software · tuzitio · reported by VulnCheckMedium 5.1
Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing session cookies and executing arbitrary JavaScript.
- Product
- Cameleon CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 10, 2025W.CVE-2025-32809 · Other software · W. W. Norton · reported by MITREMedium 6.4
W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.
- Product
- InQuizitive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025W.CVE-2025-32808 · Other software · W. W. Norton · reported by MITREHigh 7.7
W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.
- Product
- InQuizitive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allowsCVE-2024-11216 · Other software · PozitifIK · reported by iletisim@usom.gov.trHigh 7.6
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking. This issue affects Pik Online: before 3.1.5.
- Product
- Pik Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 3, 2025OpenZiti is a free and open source project focused on bringing zero trust to any application.CVE-2025-27501 · Other software · openziti · reported by GitHubHigh 8.6
OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1.
- Product
- ziti-console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025OpenZiti is a free and open source project focused on bringing zero trust to any application.CVE-2025-27500 · Other software · openziti · reported by GitHubHigh 8.2
OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL. This can lead to a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed within the context of the user's browser. This function is no longer necessary as the ziti-console moves from a node server application to a single page application, and has been disabled. The vulnerability is fixed in 3.7.1.
- Product
- ziti-console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field.CVE-2024-48652 · Other software · tuzitio · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.CVE-2023-30145 · Other software · Tuzitio · reported by MITRECritical 9.8
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
- Product
- Camaleon CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combook.hacktricks.xyz
Oct 15, 2018In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.CVE-2018-18260 · Other software · Tuzitio · reported by MITREMedium 6.1
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."
- Product
- Camaleon CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.