Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,358 results · page 2 of 48
Apr 16, 2026CodeColorer: Stored Cross-Site ScriptingCVE-2026-4032 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including, 0.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires comments to be enabled on the target post and guest comments to be allowed.
- Product
- CodeColorer
- Affected
- up to 0.10.1
- What to do
- Affects up to 0.10.1. Update CodeColorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 14, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-32084 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-32081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-32079 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database ExplorerCVE-2026-34262 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer
- Product
- SAP HANA Cockpit and HANA Database Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved.CVE-2026-5383 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 4.4
An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.
- Product
- Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Apr 5, 2026Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload CVE-2019-25661 · Other software · Lizardsystems · reported by VulnCheckMedium 6.9
Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to the added computer, overwriting the SEH chain and corrupting exception handlers.
- Product
- Remote Process Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlizardsystems.comexploit-db.com
Mar 27, 2026Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/KCVE-2026-33980 · Other software · pab1it0 · reported by GitHubHigh 8.3
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster. Commit 0abe0ee55279e111281076393e5e966335fffd30 patches the issue.
- Product
- adx-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting CVE-2018-25217 · Other software · Rttsoftware · reported by VulnCheckHigh 8.6
PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. Attackers can craft a payload with buffer overflow, NSEH jump, and ROP gadget chains that execute when the Custom fields settings dialog processes the malicious input in the Label field.
- Product
- PDF Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrttsoftware.comexploit-db.com
Mar 19, 2026Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-CVE-2026-3230 · Other software · wolfSSL · reported by facts@wolfssl.comLow 1.2
Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.
- Product
- wolfSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settingsCVE-2026-32745 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026SpotIE Internet Explorer Password Recovery 2.9.5 contains a denial of service vulnerability in the registration key input field that allows local attackers to cCVE-2019-25463 · Other software · Nsauditor · reported by VulnCheckMedium 6.9
SpotIE Internet Explorer Password Recovery 2.9.5 contains a denial of service vulnerability in the registration key input field that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a 256-character payload into the Key field during registration to trigger a buffer overflow and crash the application.
- Product
- SpotIE Internet Explorer Password Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 11, 2026MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without CVE-2026-29515 · Other software · MiCode · reported by VulnCheckCritical 9.3
MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.
- Product
- FileExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 10, 2026Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.CVE-2026-26121 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.
- Product
- Azure IoT Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a networkCVE-2026-23664 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
- Product
- Azure IoT Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-23662 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
- Product
- Azure IoT Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-23661 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
- Product
- Azure IoT Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers.CVE-2026-27818 · Other software · TerriaJS · reported by GitHubHigh 8.7
TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.
- Product
- terriajs-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026ADB Explorer is a fluent UI for ADB on Windows.CVE-2026-27615 · Other software · Alex4SSB · reported by GitHubHigh 8.8
ADB Explorer is a fluent UI for ADB on Windows. In versions prior to Beta 0.9.26022, ADB-Explorer allows the `ManualAdbPath` settings variable, which determines the path of the ADB binary to be executed, to be set to a Universal Naming Convention (UNC) path in the application's settings file. This allows an attacker to set the binary's path to point to a remote network resource, hosted on an attacker-controlled network share, thus granting the attacker full control over the binary being executed by the app. An attacker may leverage this vulnerability to execute code remotely on a victim's machine with the privileges of the user running the app. Exploitation is made possible by convincing a victim to run a shortcut of the app that points to a custom `App.txt` settings file, which sets `ManualAdbPath` (for example, when downloaded in an archive file). Version Beta 0.9.26022 fixes the issue.
- Product
- ADB-Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026ADB Explorer is a fluent UI for ADB on Windows.CVE-2026-27115 · Other software · Alex4SSB · reported by GitHubHigh 7.1
ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data directory, but only check whether the path exists. The ClearDrag() method calls Directory.Delete(dir, true) on every subdirectory of that path at both application startup and exit. An attacker can craft a malicious shortcut (.lnk) or batch script that launches ADB Explorer with a critical directory (e.g. C:\Users\%USERNAME%\Documents) as the argument, causing permanent recursive deletion of all its subdirectories. Any user who launches ADB Explorer via a crafted shortcut, batch file, or script loses the contents of the targeted directory permanently (deletion bypasses the Recycle Bin). This issue has been fixed in version 0.9.26021.
- Product
- ADB-Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Lorem Ipsum | Books & Media Store: Deserialization of Untrusted DataCVE-2025-69405 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.
- Product
- Lorem Ipsum | Books & Media Store
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Lorem Ipsum | Books & Media Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026ADB Explorer is a fluent UI for ADB on Windows.CVE-2026-26959 · Other software · Alex4SSB · reported by GitHubHigh 7.8
ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, allowing arbitrary code execution with the privileges of the current user. An attacker can exploit this by crafting a malicious App.txt settings file that points ManualAdbPath to an arbitrary executable, then convincing a victim to launch the application with a command-line argument directing it to the malicious configuration directory. This vulnerability could be leveraged through social engineering tactics, such as distributing a shortcut bundled with a crafted settings file in an archive, resulting in RCE upon application startup. Thus issue has been fixed in version 0.9.26021.
- Product
- ADB-Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026ADB Explorer is a fluent UI for ADB on Windows.CVE-2026-26208 · Other software · Alex4SSB · reported by GitHubHigh 7.8
ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnerability is fixed in Beta 0.9.26020.
- Product
- ADB-Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Product Key Explorer 4.2.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by overflowing the registration namCVE-2019-25334 · Other software · Nsasoft · reported by VulnCheckMedium 6.7
Product Key Explorer 4.2.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by overflowing the registration name input field. Attackers can create a specially crafted text file with repeated characters to trigger a buffer overflow when pasted into the registration name field, causing the application to crash.
- Product
- Nsauditor Product Key Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Feb 12, 2026Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser.CVE-2025-41117 · Other software · Grafana · reported by security@grafana.comMedium 6.8
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
- Product
- grafana/grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-21528 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
- Product
- Azure IoT Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 202610-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code CVE-2020-37142 · Other software · 10-Strike Software · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer 8.54 contains a structured exception handler buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting SEH records. Attackers can craft a malicious payload targeting the 'Computer' parameter during the 'Add' function to trigger remote code execution.
- Product
- Network Inventory Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.org10-strike.com
Feb 5, 202610-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbiCVE-2020-37138 · Other software · 10-Strike Software · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious text file with carefully constructed payload to trigger a stack-based buffer overflow and bypass data execution prevention through a ROP chain.
- Product
- Network Inventory Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record10-strike.com10-strike.com
Feb 5, 2026Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially CVE-2020-37131 · Other software · Nsauditor · reported by VulnCheckMedium 6.7
Nsauditor Product Key Explorer 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and paste it into the 'Key' input field to trigger the application crash.
- Product
- Product Key Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Feb 4, 2026Code Explorer: Path TraversalCVE-2025-15487 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Code Explorer
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Code Explorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 29, 2026Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 CVE-2026-23563 · Other software · TeamViewer · reported by psirt@teamviewer.comMedium 5.7
Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.
- Product
- DEX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 202610-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code.CVE-2020-36961 · Other software · 10-Strike Software · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code. Attackers can craft a malicious file with 209 bytes of padding and a specially constructed Structured Exception Handler to trigger code execution.
- Product
- Network Inventory Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record10-strike.comexploit-db.com
Jan 22, 2026Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-21524 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Data Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026CodeColorer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.
- Product
- CodeColorer
- Affected
- up to 0.10.1
- What to do
- Affects up to 0.10.1. Update CodeColorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privCVE-2021-47861 · Other software · FSPro Labs · reported by VulnCheckHigh 8.5
Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific file system locations that will be executed with LocalSystem account privileges during service startup.
- Product
- Event Log Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeventlogxp.comexploit-db.com
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23841 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryCreated=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23840 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryDeleted=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23839 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs.CVE-2021-47836 · Other software · jersou · reported by VulnCheckMedium 5.1
Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload markdown files with embedded JavaScript payloads that execute in the application's privileged renderer context, allowing code execution on the host.
- Product
- Markdown Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 202610-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution.CVE-2021-47772 · Other software · 10-Strike · reported by VulnCheckHigh 8.4
10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system.
- Product
- Strike Network Inventory Explorer Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record10-strike.comexploit-db.com
Jan 15, 202610-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privCVE-2021-47767 · Other software · 10-Strike · reported by VulnCheckHigh 8.5
10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.
- Product
- Strike Network Inventory Explorer Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record10-strike.comexploit-db.com
Jan 13, 2026eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request.CVE-2023-54335 · Other software · Extplorer · reported by VulnCheckCritical 9.3
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
- Product
- eXtplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextplorer.netexploit-db.com
Jan 13, 2026Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code.CVE-2023-54334 · Other software · Explorerplusplus · reported by VulnCheckHigh 7
Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code. Attackers can exploit the vulnerability by providing a long file name argument over 396 characters to corrupt the SEH chain and potentially execute malicious code.
- Product
- Explorer32++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 13, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-20939 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-20937 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-20932 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.CVE-2026-20823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.CVE-2025-68943 · Other software · Gitea · reported by MITREMedium 5.3
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Dec 15, 2025GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code throughCVE-2023-53875 · Other software · Gomlab · reported by VulnCheckHigh 7.5
GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code through DNS spoofing. Attackers can redirect victims using a malicious URL shortcut and WebDAV technique to run a reverse shell with SMB server interaction.
- Product
- GOM Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgomlab.com
Dec 11, 2025KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter.CVE-2025-34504 · Other software · kodcloud · reported by VulnCheckMedium 5.3
KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft malicious URLs in the link parameter to redirect users to arbitrary external websites after authentication.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkodcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.