Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

3,312 results · page 19 of 67

Feb 11, 2026ShareAlarmPro contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key.CVE-2020-37206 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
ShareAlarmPro contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload to trigger an application crash when pasted into the registration key field.
Product
Nsauditor ShareAlarmPro Advanced Network Access Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026RemShutdown 2.9.0.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' registration field.CVE-2020-37205 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
RemShutdown 2.9.0.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' registration field. Attackers can generate a 1000-character buffer payload and paste it into the registration name field to trigger an application crash.
Product
Nsauditor RemShutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026RemShutdown 2.9.0.0 contains a denial of service vulnerability in its registration key input that allows attackers to crash the application.CVE-2020-37204 · Other software · NSAuditor · reported by VulnCheckMedium 4.6
RemShutdown 2.9.0.0 contains a denial of service vulnerability in its registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to trigger an application crash.
Product
Nsauditor RemShutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Office Product Key Finder 1.5.4 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the registration code CVE-2020-37203 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Office Product Key Finder 1.5.4 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the registration code input. Attackers can create a specially crafted text file and paste it into the 'Name and Key' field to trigger an application crash.
Product
Nsauditor Office Product Key Finder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026NetworkSleuth 3.0.0.0 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key.CVE-2020-37202 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
NetworkSleuth 3.0.0.0 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to trigger an application crash.
Product
Nsauditor NetworkSleuth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration name input that allows attackers to crash the application.CVE-2020-37201 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration name input that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor NetShareWatcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration key input that allows attackers to crash the application by supplying oversCVE-2020-37200 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration key input that allows attackers to crash the application by supplying oversized input. Attackers can generate a 1000-character payload and paste it into the registration key field to trigger an application crash.
Product
Nsauditor NetShareWatcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026NBMonitor 1.6.6.0 contains a denial of service vulnerability in its registration key input that allows attackers to crash the application.CVE-2020-37199 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
NBMonitor 1.6.6.0 contains a denial of service vulnerability in its registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
Product
Nsauditor NBMonitor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by providing an oversized registratioCVE-2020-37196 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by providing an oversized registration key. Attackers can generate a 1000-character buffer payload and paste it into the registration key field to trigger an application crash.
Product
Nsauditor Dnss Domain Name Search Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026BlueAuditor 1.7.2.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37195 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
BlueAuditor 1.7.2.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Product
BlueAuditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by supplying an overly long registration keyCVE-2020-37194 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by supplying an overly long registration key. Attackers can generate a 1000-character payload file and paste it into the registration key field to trigger an application crash.
Product
Nsauditor Backup Key Recovery Recover Keys Crashed Hard Disk Drive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application.CVE-2020-37189 · Other software · DigitalVolcano Software · reported by VulnCheckMedium 4.6
TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the registration field to trigger an application crash.
Product
TaskCanvas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalvolcano.co.uk digitalvolcano.co.uk
Feb 11, 2026SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37188 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can overwrite the buffer by pasting 1000 'A' characters into the 'Name' field, causing the application to become unresponsive.
Product
Nsauditor SpotOutlook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37187 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor SpotDialup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026GTalk Password Finder 2.2.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration keyCVE-2020-37180 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
GTalk Password Finder 2.2.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash.
Product
Nsauditor GTalk Password Finder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module.CVE-2025-69871 · Other software · reported by MITREHigh 8.1
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage limits by sending concurrent checkout requests, resulting in unlimited redemptions of limited-use promotional codes and potential financial loss.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2026An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) CVE-2025-13650 · Other software · Microcom · reported by ffb98d57-deaa-4918-a669-5225ccc13e39Medium 5.1
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Surname’ parameter of the ‘Create Account’ operation at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.
Product
ZeusWeb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackrtu.com hackrtu.com
Feb 11, 2026An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performedCVE-2025-13649 · Other software · Microcom · reported by ffb98d57-deaa-4918-a669-5225ccc13e39Medium 5.1
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Email’ parameters within the ‘Recover password’ section at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.
Product
ZeusWeb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackrtu.com hackrtu.com
Feb 11, 2026An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software couldCVE-2025-13648 · Other software · Microcom · reported by ffb98d57-deaa-4918-a669-5225ccc13e39Medium 4.8
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.
Product
ZeusWeb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackrtu.com hackrtu.com
Feb 10, 2026Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.CVE-2024-21953 · Other software · AMD · reported by psirt@amd.comMedium 5.9
Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.
Product
AMD EPYC™ 9004 Series Processors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Feb 7, 2026JAY Login & Register: Privilege EscalationCVE-2025-15100 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Product
JAY Login & Register
Affected
up to 2.6.03
What to do
Affects up to 2.6.03. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026JAY Login & Register: Privilege EscalationCVE-2025-15027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_login_register_ajax_create_final_user' function. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Product
JAY Login & Register
Affected
up to 2.6.03
What to do
Affects up to 2.6.03. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 6, 2026Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwritCVE-2020-37162 · Other software · Wedding Slideshow Studio · reported by VulnCheckHigh 8.4
Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and execute commands through the registration key field.
Product
Wedding Slideshow Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Feb 6, 2026Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name fielCVE-2020-37161 · Other software · Wedding Slideshow Studio · reported by VulnCheckHigh 8.4
Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability to run system commands like launching the calculator.
Product
Wedding Slideshow Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wedding-slideshow-studio.com exploit-db.com
Feb 6, 2026Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory registers in the alarCVE-2020-37159 · Other software · Parallaxis · reported by VulnCheckHigh 8.4
Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory registers in the alarm scheduling feature. Attackers can craft a malicious payload exceeding 260 bytes to overwrite EIP and EBP, enabling shellcode execution with potential remote code execution.
Product
Cuckoo Clock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.softonic.com exploit-db.com
Feb 5, 2026HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registratioCVE-2020-37145 · Other software · HRSALE · reported by VulnCheckMedium 5.1
HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registration form. Attackers can craft a malicious HTML page with hidden form fields to trick authenticated administrators into creating new user accounts with elevated privileges.
Product
HRSALE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Feb 5, 2026Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37130 · Other software · Nsauditor · reported by VulnCheckMedium 6.7
Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted into the registration name field.
Product
Nsauditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the siCVE-2025-71195 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault: tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[121
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() failCVE-2025-71192 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 3, 2026Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the NLST command that allows attackers to overwrite system registers.CVE-2020-37069 · Other software · Konica Minolta · reported by VulnCheckHigh 8.7
Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the NLST command that allows attackers to overwrite system registers. Attackers can send an oversized buffer of 1500 'A' characters to crash the FTP server and potentially execute unauthorized code.
Product
FTP Utility
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record konica-minolta-ftp-utility.software.informer.com exploit-db.com
Feb 3, 2026Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command that allows attackers to overwrite system registers.CVE-2020-37068 · Other software · Konica Minolta · reported by VulnCheckHigh 8.7
Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command that allows attackers to overwrite system registers. Attackers can send an oversized buffer of 1500 'A' characters to crash the FTP server and potentially execute unauthorized code.
Product
FTP Utility
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record konica-minolta-ftp-utility.software.informer.com exploit-db.com
Feb 3, 2026GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption.CVE-2020-37115 · Other software · Openeclass · reported by VulnCheckHigh 7.1
GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access.
Product
GUnet OpenEclass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.openeclass.org exploit-db.com
Jan 31, 2026In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot isCVE-2025-71182 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 30, 2026Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long request in the RegistCVE-2020-37025 · Other software · iForwarder and upRedSun Technologies, LLC. · reported by VulnCheckHigh 8.4
Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long request in the Register feature. Attackers can craft a malicious payload with an egg tag and overwrite SEH handlers to potentially execute shellcode on vulnerable Windows systems.
Product
Port Forwarding Wizard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record port-forwarding.net exploit-db.com
Jan 30, 2026Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers to execute arbitrary CVE-2020-37024 · Other software · Nidesoft Studio · reported by VulnCheckHigh 8.4
Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the License Code field to trigger a stack-based buffer overflow and execute shellcode.
Product
Nidesoft DVD Ripper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nidesoft-dvd-ripper.softonic.com exploit-db.com
Jan 30, 2026A flaw was found in Undertow.CVE-2024-4027 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
Product
Red Hat build of Apicurio Registry 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Jan 29, 2026Audio Playback Recorder 3.2.2 contains a local buffer overflow vulnerability in the eject and registration parameters that allows attackers to execute arbitraryCVE-2020-37013 · Other software · Tucows Inc. · reported by VulnCheckHigh 8.4
Audio Playback Recorder 3.2.2 contains a local buffer overflow vulnerability in the eject and registration parameters that allows attackers to execute arbitrary code. Attackers can craft malicious payloads and overwrite Structured Exception Handler (SEH) to execute shellcode when pasting specially crafted input into the application's input fields.
Product
Audio Playback Recorder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.org web.archive.org
Jan 28, 2026Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter.CVE-2020-36971 · Other software · Nidesoft · reported by VulnCheckHigh 8.4
Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers can craft a malicious payload and paste it into the 'License Code' field to execute arbitrary code on the system.
Product
Nidesoft 3GP Video Converter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nidesoft-3gp-video-converter.software.informer.com exploit-db.com
Jan 28, 2026WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulatiCVE-2020-36945 · Other software · WEBDAMN.COM · reported by VulnCheckHigh 8.8
WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating email credentials. Attackers can inject the payload '<email>' OR '1'='1' in both username and password fields to gain unauthorized access to the user panel.
Product
WebDamn User Registration & Login System with User Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record webdamn.com webdamn.com
Jan 28, 2026Simple User Registration: Privilege escalationCVE-2026-0844 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Product
Simple User Registration
Affected
up to 6.7
What to do
Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026RegistrationMagic: Missing AuthorizationCVE-2026-1054 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
Product
RegistrationMagic
Affected
up to 6.0.7.4
What to do
Affects up to 6.0.7.4. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2026Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields.CVE-2020-36978 · Other software · Froxlor · reported by VulnCheckMedium 5.1
Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.
Product
Froxlor Froxlor Server Management Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record froxlor.org froxlor.org
Jan 27, 2026Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially exeCVE-2020-36976 · Other software · Acer · reported by VulnCheckHigh 8.5
Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Acer\Registration\ to inject malicious executables that would run with elevated LocalSystem privileges during service startup.
Product
Global Registration Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record acer.com exploit-db.com
Jan 26, 2026The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside.CVE-2025-59109 · Other software · dormakaba · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.1
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
Product
dormakaba registration unit 9002
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com r.sec-consult.com
Jan 24, 2026JustClick registration: Reflected Cross-Site ScriptingCVE-2025-13676 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on the `PHP_SELF` server variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
JustClick registration
Affected
up to 0.1
What to do
Affects up to 0.1. Update JustClick registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregisterCVE-2026-22994 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md().
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 23, 2026Pie Register: Missing AuthorizationCVE-2026-24577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.
Product
Pie Register
Affected
up to 3.8.4.8
What to do
Affects up to 3.8.4.8. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automaticaCVE-2025-71156 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatically enabled immediately upon request. This allows interrupt to fire before the associated NAPI context is fully initialized and cause failures like below: [ 0.946369] Call Trace: [ 0.946369] <IRQ> [ 0.946369] __napi_poll+0x2a/0x1e0 [ 0.946369] net_rx_action+0x2f9/0x3f0 [ 0.946369] handle_softirqs+0xd6/0x2c0 [ 0.946369] ? handle_edge_irq+0xc1/0x1b0 [ 0.946369] __irq_exit_rcu+0xc3/0xe0 [ 0.946369] common_interrupt+0x81/0xa0 [ 0.946369] </IRQ> [ 0.946369] <TASK> [ 0.946369] asm_common_interrupt+0x22/0x40 [ 0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10 Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto enablement and explicitly enable the interrupt in NAPI initialization path (and disable it during NAPI teardown). This ensures that interrupt lifecycle is strictly coupled with readiness of NAPI context.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 23, 2026In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), wCVE-2025-71154 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jan 22, 2026RegistrationMagic: Cross-Site Request Forgery (CSRF)CVE-2026-24374 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through <= 6.0.6.9.
Product
RegistrationMagic
Affected
up to 6.0.6.9
What to do
Affects up to 6.0.6.9. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.