Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,231 results · page 11 of 45
Jan 21, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-23630 · Other software · docmost · reported by GitHubMedium 6.3
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` fCVE-2025-56005 · Other software · Red Hat · reported by MITRECritical 9.8
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Product
- Fence Agents Remediation Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots.CVE-2026-23875 · Other software · crawlchat · reported by GitHubMedium 5.7
CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.
- Product
- crawlchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026WeasyPrint helps web developers to create PDF documents.CVE-2025-68616 · Other software · Kozea · reported by GitHubHigh 7.5
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
- Product
- WeasyPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Filr – Secure document library: Stored Cross-Site ScriptingCVE-2025-14632 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.
- Product
- Filr – Secure document library
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Filr – Secure document library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026Docmost is an open-source collaborative wiki and documentation software.CVE-2026-22249 · Other software · docmost · reported by GitHubHigh 7.1
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026LaSuite Doc is a collaborative note taking, wiki and documentation platform.CVE-2026-22867 · Other software · suitenumerique · reported by GitHubHigh 8.7
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation.CVE-2026-22237 · Other software · Bluspark Global · reported by 56a186b1-7f5e-4314-ba38-38d5499fccfdCritical 10
The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation. Successful exploitation of this vulnerability could allow the attacker to cause damage to the targeted platform by abusing internal functionality.
- Product
- BLUVOYIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by maCVE-2022-50932 · Other software · KYOCERA Document Solutions · reported by VulnCheckHigh 8.7
Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. Attackers can exploit the issue by sending requests like /js/../../../../.../etc/passwd%00.jpg (null-byte appended traversal) to access critical files such as /etc/passwd and /etc/shadow.
- Product
- Kyocera Command Center RX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comkyoceradocumentsolutions.com
Jan 12, 2026A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.CVE-2021-41074 · Other software · Webkul · reported by MITREMedium 5.4
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document.
- Product
- Qloapps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, useCVE-2025-41078 · Other software · Viafirma · reported by cve-coordination@incibe.esHigh 8.7
Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.
- Product
- Viafirma Documents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.CVE-2026-22688 · Other software · Tencent · reported by GitHubCritical 9.9
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.
- Product
- WeKnora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.CVE-2026-22687 · Other software · Tencent · reported by GitHubMedium 5.6
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent service, it allows users to call the database query tool. Due to insufficient backend validation, an attacker can use prompt‑based bypass techniques to evade query restrictions and obtain sensitive information from the target server and database. This issue has been patched in version 0.2.5.
- Product
- WeKnora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026A security issue was discovered in GNU Wget2 when handling Metalink documents.CVE-2025-69194 · Other software · GNU · reported by patrick@puiterwijk.orgHigh 8.8
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Product
- Wget2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jan 9, 2026Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may beCVE-2025-70974 · Other software · Alibaba · reported by MITRECritical 10
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber'CVE-2026-22235 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
- Product
- eComplaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality.CVE-2026-22231 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user views the Action History Log. Fixed in OPEXUS eCASE Platform 11.14.1.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 6, 2026FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-sCVE-2020-36905 · Other software · FIBAR GROUP S.A. · reported by VulnCheckMedium 5.1
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
- Product
- Home Center 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Dec 31, 2025Knowledge Base documentation & wiki plugin – BasePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BasePress Knowledge Base documentation & wiki plugin – BasePress basepress allows Stored XSS.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through <= 2.17.0.1.
- Product
- Knowledge Base documentation & wiki plugin – BasePress
- Affected
- up to 2.17.0.1
- What to do
- Affects up to 2.17.0.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2025A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document.CVE-2025-25341 · Other software · Libxmljs Project · reported by MITREHigh 7.5
A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl nodes causes a segmentation fault, potentially leading to a denial-of-service (DoS).
- Product
- Libxmljs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name.CVE-2025-68936 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window.CVE-2025-68935 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form.CVE-2025-68917 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes.CVE-2018-25146 · Other software · Microhard Systems · reported by VulnCheckHigh 7.1
Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service disruption and requiring device restart.
- Product
- Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Service Control DoS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrohardcorp.comexploit-db.com
Dec 24, 2025WP Document Revisions: Missing AuthorizationCVE-2025-68585 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Document Revisions: from n/a through <= 3.7.2.
- Product
- WP Document Revisions
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WP Document Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025F70 Lead Document Download: Unauthorized access of dataCVE-2025-14633 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to download any file from the WordPress media library by guessing or enumerating WordPress attachment IDs.
- Product
- F70 Lead Document Download
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update F70 Lead Document Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type toCVE-2025-68386 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassiCVE-2023-53944 · Other software · Easyphp · reported by VulnCheckHigh 7.1
EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini.
- Product
- EasyPHP Webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeasyphp.orgexploit-db.com
Dec 17, 2025Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Stored Cross-Site ScriptingCVE-2025-12885 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
- Affected
- up to 2.7.10
- What to do
- Affects up to 2.7.10. Update Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 17, 2025KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribuCVE-2025-65203 · Other software · Keepassxc · reported by MITREHigh 7.1
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to access populated form fields and exfiltrate credentials.
- Product
- Keepassxc-browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows CVE-2025-65319 · Other software · Blixhq · reported by MITRECritical 9.1
When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
- Product
- Bluemail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Dec 16, 2025When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows aCVE-2025-65318 · Other software · Canarymail · reported by MITRECritical 9.1
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
- Product
- Canary Mail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Dec 16, 2025Document Library Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67986 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows DOM-Based XSS.This issue affects Document Library Lite: from n/a through <= 1.1.7.
- Product
- Document Library Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Document Library Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Document Library Lite: Authorization Bypass Through User-Controlled KeyCVE-2025-67985 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through <= 1.1.7.
- Product
- Document Library Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Document Library Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) CVE-2025-14714 · Other software · The Document Foundation · reported by security@documentfoundation.orgLow 0.9
An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2025Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, suCVE-2025-36752 · Other software · Growatt · reported by csirt@divd.nlCritical 9.4
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.
- Product
- ShineLan-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestriCVE-2025-65294 · Other software · Aqara · reported by MITRECritical 9.8
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
- Product
- HUB M2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal.CVE-2025-65815 · Other software · Uniteddevelopers · reported by MITREMedium 6.5
A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal.
- Product
- Document Reader\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.android.comgithub.com
Dec 9, 2025Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented pageCVE-2021-47731 · Other software · Selea s.r.l. · reported by VulnCheckCritical 9.3
Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented page. Attackers can exploit the hidden endpoint by using the hard-coded password 'Selea781830' to enable configuration upload and overwrite device settings.
- Product
- Selea Targa IP OCR-ANPR Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66457 · Other software · elysiajs · reported by GitHubHigh 7.5
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66456 · Other software · elysiajs · reported by GitHubCritical 9.1
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g.CVE-2025-41697 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.8
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access CVE-2025-41696 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 4.6
An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
- Product
- FL SWITCH 2005
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online.CVE-2025-66208 · Other software · CollaboraOnline · reported by GitHubHigh 7.2
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php and an intermediate reverse proxy. This vulnerability is fixed in 25.04.702.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Malicious content at office documents can be used to inject script code when editing a document.CVE-2025-30190 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 5.4
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Nov 25, 2025MongoDB Server may experience an invariant failure during batched delete operations when handling documents.CVE-2025-13644 · Other software · MongoDB Inc. · reported by cna@mongodb.comHigh 7.1
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and CVE-2025-13507 · Other software · MongoDB Inc. · reported by cna@mongodb.comHigh 7.1
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key UsaCVE-2025-12893 · Other software · MongoDB Inc. · reported by cna@mongodb.comLow 2.3
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly perCVE-2025-34333 · Other software · AudioCodes Limited · reported by VulnCheckHigh 8.5
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.
- Product
- AudioCodes Fax/IVR Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Nov 17, 2025NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management.CVE-2025-64766 · Other software · NixOS · reported by GitHubMedium 5.3
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.
- Product
- nixpkgs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.