Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
248 results · page 2 of 5
Jul 29, 2026In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication toCVE-2026-16326 · Other software · HashiCorp · reported by security@hashicorp.comCritical 10
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd.CVE-2026-4773 · Other software · Magarsus Consulting Ltd. Co. · reported by iletisim@usom.gov.trHigh 8.1
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.
- Product
- IDM-MFA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd.CVE-2026-6793 · Other software · Bifra Engineering Consulting Ltd. · reported by iletisim@usom.gov.trMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7.
- Product
- Q-smart NexT Poll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and CVE-2026-8297 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.CVE-2026-11763 · Other software · Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. · reported by iletisim@usom.gov.trMedium 6.5
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
- Product
- GisLab Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd.CVE-2026-5801 · Other software · Semtek Informatics Software Consulting Trade Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection. This issue affects SEM-PMP: through 23042026.
- Product
- SEM-PMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics Technology Consulting, Trade and EducatCVE-2026-5005 · Other software · Twiser Informatics Technology Consulting, Trade and Education Inc. · reported by iletisim@usom.gov.trMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Twiser Informatics Technology Consulting, Trade and Education Inc. OKRs & Goals allows Stored XSS. This issue affects OKRs & Goals: from 28220 before 28398.
- Product
- OKRs & Goals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output toCVE-2026-14361 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.7
The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc.CVE-2026-6280 · Other software · NOMYSOFT Informatics Education and Consulting Inc. · reported by iletisim@usom.gov.trMedium 6.5
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Nomysem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc.CVE-2026-5799 · Other software · Idvlabs Software and Consulting Services Inc. · reported by iletisim@usom.gov.trHigh 7.5
Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.
- Product
- Ontime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc.CVE-2026-5730 · Other software · Idvlabs Software and Consulting Services Inc. · reported by iletisim@usom.gov.trHigh 7.5
Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.
- Product
- Ontime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics TechnCVE-2026-11561 · Other software · Soagen Informatics Technologies Software and Consulting Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.
- Product
- Apinizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd.CVE-2025-13479 · Other software · PosCube Hardware Software and Consulting Ltd. · reported by iletisim@usom.gov.trHigh 7.5
Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- QR Menu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS recorCVE-2026-42923 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.9
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTCVE-2026-4320 · Other software · Creartia Internet Consulting · reported by cve-coordination@incibe.esCritical 9.3
Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials.
- Product
- ICMS Content Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and OrganizationCVE-2026-7498 · Other software · Basamak Information Technology Consulting and Organization Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS. This issue affects DernekWeb: through 30122025.
- Product
- DernekWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry anCVE-2025-15024 · Other software · Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 8.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Remote Code Inclusion. This issue affects Library Automation System: from v.19.5 before v.22.1.
- Product
- Library Automation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc.CVE-2025-15023 · Other software · Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 8.8
Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Library Automation System: from v.19.5 before v.22.1.
- Product
- Library Automation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade ICVE-2025-15025 · Other software · Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 8.8
Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploitation of Trusted Identifiers. This issue affects Library Automation System: from v.21.6 before v.22.1.
- Product
- Library Automation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox fiCVE-2026-5061 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.7
The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allowCVE-2026-3120 · Other software · Profelis Information and Consulting Trade and Industry Limited Company · reported by iletisim@usom.gov.trHigh 7.2
Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection. This issue affects SambaBox: from 5.1 before 5.3.
- Product
- SambaBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 27, 2026The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) rCVE-2026-27172 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs. This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orgaccess.redhat.com
Apr 2, 2026Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to exCVE-2026-30252 · Other software · Interzen · reported by MITREMedium 6.1
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.
- Product
- Zencrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execCVE-2026-30251 · Other software · Interzen · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda parameter.
- Product
- Zenshare Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A vulnerability was detected in raine consult-llm-mcp up to 2.5.3.CVE-2026-5125 · Other software · raine · reported by VulDBLow 1.9
A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_process.execSync of the file src/server.ts. The manipulation of the argument git_diff.base_ref/git_diff.files results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 2.5.4 addresses this issue. The patch is identified as 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Upgrading the affected component is recommended.
- Product
- consult-llm-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication.CVE-2026-2808 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.8
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026InputMapper 1.6.10 contains a buffer overflow vulnerability in the username field that allows local attackers to crash the application by entering an excessivelCVE-2019-25464 · Other software · DSD Consulting Services LLC. · reported by VulnCheckMedium 6.7
InputMapper 1.6.10 contains a buffer overflow vulnerability in the username field that allows local attackers to crash the application by entering an excessively long string. Attackers can trigger a denial of service by copying a large payload into the username field and double-clicking to process it, causing the application to crash.
- Product
- InputMapper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Mar 5, 2026Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application funcCVE-2026-26418 · Other software · TCS · reported by MITREHigh 7.5
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reCVE-2026-26417 · Other software · TCS · reported by MITREHigh 8.1
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaCVE-2026-26416 · Other software · TCS · reported by MITREHigh 8.8
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests.
- Product
- Cognix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Consultor | Consulting, Accounting & Legal Counsel: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27336 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Consultor | Consulting, Accounting & Legal Counsel WordPress Theme consultor allows PHP Local File Inclusion.This issue affects Consultor | Consulting, Accounting & Legal Counsel WordPress Theme: from n/a through <= 1.2.4.
- Product
- Consultor | Consulting, Accounting & Legal Counsel
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Consultor | Consulting, Accounting & Legal Counsel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd.CVE-2025-9953 · Other software · DATABASE Software Training Consulting Ltd. · reported by iletisim@usom.gov.trCritical 9.8
Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026/04.
- Product
- Databank Accreditation Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 17, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information AdvertisCVE-2025-7631 · Other software · Tumeva Internet Technologies Software Information Advertising and Consulting Services Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information Advertising and Consulting Services Trade Ltd. Co. Tumeva Prime News Software allows SQL Injection. This issue affects Tumeva Prime News Software: from v.1.0.1 before v1.0.2.
- Product
- Tumeva Prime News Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 9, 2026Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.CVE-2026-1960 · Other software · Loggro Pymes · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.
- Product
- Loggro Pymes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with aCVE-2020-37109 · Other software · asc Applied Software Consultants · reported by VulnCheckMedium 6.7
aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with a large buffer. Attackers can generate a 1000-character buffer and paste it into the Subject title to trigger an application crash and potential instability.
- Product
- aSc TimeTables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasctimetables.comexploit-db.com
Jan 28, 2026aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with excesCVE-2020-36943 · Other software · asc Applied Software Consultants, s.r.o. · reported by VulnCheckMedium 6.7
aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with excessive data. Attackers can generate a 10,000-character buffer and paste it into the subject title to trigger application instability and potential crash.
- Product
- asc Timetables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasctimetables.comasctimetables.com
Jan 22, 2026Consult Aid: Deserialization of Untrusted DataCVE-2025-67617 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
- Product
- Consult Aid
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Consult Aid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuCVE-2026-22537 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 6.8
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Consulting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Consulting consulting allows Stored XSS.This issue affects Consulting: from n/a through <= 1.5.0.
- Product
- Consulting
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 22, 2025Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc.CVE-2025-14018 · Other software · NetBT Consulting Services Inc. · reported by iletisim@usom.gov.trHigh 7.3
Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries. This issue affects e-Fatura: before 1.2.15.
- Product
- e-Fatura
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 18, 2025Sale! Immigration law, Visa services support, Migration Agent Consulting: Incorrect Privilege AssignmentCVE-2025-59134 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.
- Product
- Sale! Immigration law, Visa services support, Migration Agent Consulting
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Sale! Immigration law, Visa services support, Migration Agent Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2025Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc.CVE-2025-13003 · Other software · Aksis Computer Services and Consulting Inc. · reported by iletisim@usom.gov.trHigh 7.6
Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0.
- Product
- AxOnboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 10, 2025Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc.CVE-2025-1161 · Other software · NomySoft Information Technology Training and Consulting Inc. · reported by iletisim@usom.gov.trHigh 7.1
Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.
- Product
- Nomysem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 31, 2025Consulting Elementor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
- Product
- Consulting Elementor Widgets
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Consulting Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Consulting Elementor Widgets: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64360 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
- Product
- Consulting Elementor Widgets
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Consulting Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Consulting: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64359 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through < 6.7.5.
- Product
- Consulting
- What to do
- Update Consulting to the newest version.
Oct 28, 2025Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header.CVE-2025-11375 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.5
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation.CVE-2025-11374 · Other software · HashiCorp · reported by security@hashicorp.comMedium 6.5
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and ForeignCVE-2025-10610 · Other software · SFS Consulting Information Processing Industry and Foreign Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.
- Product
- Winsure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 2, 2025Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd.CVE-2025-0642 · Other software · PosCube Hardware Software and Consulting Ltd. Co. · reported by iletisim@usom.gov.trMedium 6.3
Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass. This issue affects Assist: through 10.02.2025.
- Product
- Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.