Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,317 results · page 135 of 587
Feb 9, 2026Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memoryCVE-2026-24320 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.
- Product
- SAP NetWeaver and ABAP Platform (Application Server ABAP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repCVE-2026-23689 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
- Product
- SAP Supply Chain Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modifiCVE-2026-23687 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafCVE-2026-23686 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.4
Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crCVE-2026-23685 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.4
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
- Product
- SAP NetWeaver (JMS service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the reqCVE-2026-0509 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, wCVE-2026-0490 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on the availability but no impact on the confidentiality and integrity.
- Product
- SAP BusinessObjects BI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code CVE-2026-0484 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system. This vulnerability has a high impact on integrity of the application with no effect on the confidentiality and availability.
- Product
- SAP NetWeaver Application Server ABAP and SAP S/4HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view.CVE-2026-25923 · Other software · My-Little-Forum · reported by GitHubHigh 8.7
my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1.
- Product
- mylittleforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Sliver is a command and control framework that uses a custom Wireguard netstack.CVE-2026-25791 · Other software · BishopFox · reported by GitHubHigh 7.5
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was determined in janet-lang janet up to 1.40.1.CVE-2026-2242 · Other software · janet-lang · reported by VulDBLow 1.9
A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability was found in janet-lang janet up to 1.40.1.CVE-2026-2241 · Other software · janet-lang · reported by VulDBLow 1.9
A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is named 0f285855f0e34f9183956be5f16e045f54626bff. To fix this issue, it is recommended to deploy a patch.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026A vulnerability has been found in janet-lang janet up to 1.40.1.CVE-2026-2240 · Other software · janet-lang · reported by VulDBLow 1.9
A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5. A patch should be applied to remediate this issue.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Crafted zones can lead to increased incoming network traffic.CVE-2026-24027 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
Crafted zones can lead to increased incoming network traffic.
- Product
- Recursor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd.CVE-2025-7708 · Other software · Atlas Educational Software Industry Ltd. Co. · reported by iletisim@usom.gov.trMedium 6.8
Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulation. This issue affects k12net: through 26072025.
- Product
- k12net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 9, 2026The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a ManCVE-2026-22613 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton Network M3 which is available on the Eaton download center.
- Product
- Network M3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A weakness has been identified in detronetdip E-commerce 1.0.0.CVE-2026-2165 · Websites & servers · detronetdip · reported by VulDBMedium 5.5
A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- E-commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A security flaw has been discovered in detronetdip E-commerce 1.0.0.CVE-2026-2164 · Websites & servers · detronetdip · reported by VulDBMedium 5.5
A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- E-commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application.CVE-2020-37166 · Other software · Celestial Software · reported by VulnCheckMedium 6.9
AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name.CVE-2020-37165 · Other software · Celestial Software · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license name field to trigger an application crash.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name.CVE-2020-37164 · Other software · Celestial Software · reported by VulnCheckMedium 6.7
AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.
- Product
- AbsoluteTelnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcelestialsoftware.netexploit-db.com
Feb 6, 2026Antrea is a Kubernetes networking solution intended to be Kubernetes native.CVE-2026-25804 · Other software · antrea-io · reported by GitHubHigh 8
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.
- Product
- antrea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Nebula is a scalable overlay networking tool.CVE-2026-25793 · Other software · slackhq · reported by GitHubHigh 7.6
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.
- Product
- nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Sliver is a command and control framework that uses a custom Wireguard netstack.CVE-2026-25760 · Other software · BishopFox · reported by GitHubMedium 6.5
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks.CVE-2026-25632 · Other software · WaterFutures · reported by GitHubCritical 10
EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.
- Product
- EPyT-Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.CVE-2026-25643 · Other software · blakeblackshear · reported by GitHubCritical 9.1
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.
- Product
- frigate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OrcaStatLLM Researcher is an LLM Based Research Paper Generator.CVE-2026-24903 · Other software · AlgoNetLab · reported by GitHubMedium 5.3
OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in OrcaStatLLM-Researcher that allows attackers to inject and execute arbitrary JavaScript code in victims' browsers through malicious research topic inputs.
- Product
- OrcaStatLLM-Researcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2026-21643 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedCritical 9.8
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
- Product
- FortiClient EMS
- On CISA’s list since
- Apr 13, 2026 (federal fix deadline Apr 16, 2026)
- What to do
- Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfortiguard.fortinet.comgithub.com
Feb 5, 2026A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuCVE-2025-15566 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-24302 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.CVE-2026-0391 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 throuCVE-2026-25815 · Network & remote access · Fortinet · reported by MITRELow 3.2
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.fortinet.comcert.at
Feb 5, 2026A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service.CVE-2025-12131 · Other software · silabs.com · reported by product-security@silabs.comMedium 5.3
A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service.
- Product
- EmberZNet SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an atCVE-2025-58190 · Other software · golang.org/x/net · reported by security@golang.orgMedium 5.3
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- Product
- golang.org/x/net/html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if aCVE-2025-47911 · Other software · golang.org/x/net · reported by security@golang.orgMedium 5.3
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- Product
- golang.org/x/net/html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept anCVE-2025-15557 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.5
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
- Product
- Tapo H100 v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Feb 5, 202610-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code CVE-2020-37142 · Other software · 10-Strike Software · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigger remote code execution.
- Product
- Network Inventory Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.org10-strike.com
Feb 5, 202610-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbiCVE-2020-37138 · Other software · 10-Strike Software · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious text file with carefully constructed payload to trigger a stack-based buffer overflow and bypass data execution prevention through a ROP chain.
- Product
- Network Inventory Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record10-strike.com10-strike.com
Feb 4, 2026TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code.CVE-2019-25272 · Other software · Tenaxsoft · reported by VulnCheckHigh 8.5
TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\TenaxSoft\CyberPlanet\SrvProxy.exe' to inject malicious executables and gain elevated system privileges.
- Product
- TexasSoft CyberPlanet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenaxsoft.comexploit-db.com
Feb 4, 2026NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration.CVE-2019-25271 · Other software · NETGATE · reported by VulnCheckHigh 8.5
NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific directory locations.
- Product
- Data Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetgate.skexploit-db.com
Feb 4, 2026Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations.CVE-2019-25269 · Other software · Netgate · reported by VulnCheckHigh 8.5
Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.
- Product
- Amiti Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetgate.skexploit-db.com
Feb 4, 2026HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks.CVE-2026-25543 · Other software · mganss · reported by GitHubMedium 6.3
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.
- Product
- HtmlSanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Mastodon is a free, open-source social network server based on ActivityPub.CVE-2026-25540 · Other software · mastodon · reported by GitHubMedium 6.5
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via `Rails.cache. When AUTHORIZED_FETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.
- Product
- mastodon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Devtron is an open source tool integration platform for Kubernetes.CVE-2026-25538 · Other software · devtron-labs · reported by GitHubHigh 8.7
Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user (including low-privileged CI/CD Developers) to obtain the global API Token signing key by accessing the /orchestrator/attributes?key=apiTokenSecret endpoint. After obtaining the key, attackers can forge JWT tokens for arbitrary user identities offline, thereby gaining complete control over the Devtron platform and laterally moving to the underlying Kubernetes cluster. This issue has been patched via commit d2b0d26.
- Product
- devtron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using thoCVE-2026-25518 · Other software · cert-manager · reported by GitHubMedium 5.9
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. In versions from 1.18.0 to before 1.18.5 and from 1.19.0 to before 1.19.3, the cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in denial‑of‑service (DoS) of the cert-manager controller. The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor. This issue has been patched in versions 1.18.5 and 1.19.3.
- Product
- cert-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site ScripCVE-2026-0947 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XCVE-2026-0946 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resCVE-2025-2134 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resource pooling.
- Product
- Jazz Reporting Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server.CVE-2025-27550 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server.
- Product
- Jazz Reporting Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes exCVE-2025-1823 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes excess memory resources.
- Product
- Jazz Reporting Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.