Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

151 results · page 2 of 4

Jun 18, 2026Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries.CVE-2025-10560 · Other software · Silver Leaf Technologies, Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.3
Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials authenticated as the AWS account root identity and provided access to Worksnaps production cloud resources, including S3 buckets containing sensitive data such as screenshots of user desktops. An attacker with access to the affected client binaries could extract or recover the credentials and use them to access affected Worksnaps cloud resources.
Product
Worksnaps.net Worksnaps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com worksnaps.net
Jun 11, 2026Cerebrate before version 1.37 exposed credential material from self-registration requests.CVE-2026-53912 · Other software · cerebrate · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This payload was returned unredacted through inbox index and view responses, including HTML, JSON, and CSV outputs, and could also be written unredacted into audit log entries for the inbox message. An authenticated user with sufficient privileges to access inbox entries or related audit logs could retrieve password hashes associated with pending self-registration requests. Although the exposed value is a password hash rather than a plaintext password, disclosure of password hashes may enable offline password-cracking attempts and could increase risk where users reuse passwords across systems. Cerebrate 1.37 fixes the issue by redacting sensitive password and authkey fields from inbox display/API output and recursively redacting those fields from JSON values written to audit logs, while leaving the stored registration payload intact for account creation processing. Affected component: Inbox self-registration request handling and audit logging Fixed version: Cerebrate 1.37
Product
cerebrate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 4, 2026The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attaCVE-2026-36178 · Other software · reported by MITREMedium 4.6
The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive user data.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 28, 2026An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary cCVE-2026-30761 · Other software · reported by MITREHigh 7.3
An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary code via uploading a crafted image file.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
May 28, 2026An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call.CVE-2026-30760 · Other software · reported by MITREHigh 7.3
An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
May 27, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-45083 · Other software · intranda · reported by GitHubCritical 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression from unauthenticated network clients and forwarded it to the backend Solr server without restriction. An attacker could read the complete Solr index and, in default Solr deployments, also modify or delete indexed records. This vulnerability is fixed in 26.04.1.
Product
goobi-viewer-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() componentsCVE-2025-70072 · Other software · reported by MITREMedium 6.5
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
May 4, 2026An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() methodCVE-2025-70069 · Other software · Red Hat · reported by MITREHigh 7.5
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com access.redhat.com
Apr 23, 2026A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud PlatfCVE-2026-3259 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.1
A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Platform allows an authenticated user to potentially disclose sensitive data using a crafted materialized view that triggers a runtime error during the refresh process. This vulnerability was patched on 29 January 2026, and no customer action is needed.
Product
BigQuery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cloud.google.com
Apr 18, 2026UI / API User with asset materialize permission could trigger dags they had no access to.CVE-2026-32228 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
Product
Apache Airflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Apr 17, 2026Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interactiCVE-2026-32324 · Other software · Anviz · reported by ics-cert@hq.dhs.govHigh 7.7
Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.
Product
Anviz CX7 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com anviz.com
Apr 13, 2026The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive iCVE-2026-27672 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system.
Product
Material Master Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com url.sap
Apr 7, 2026coursevault-preview is a utility for previewing course material files from a configured directory.CVE-2026-35613 · Other software · moritzmyrz · reported by GitHubMedium 5.1
coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.
Product
coursevault-preview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 26, 2026Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.CVE-2026-33481 · Other software · anchore · reported by GitHubMedium 5.3
Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There
Product
syft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2026Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.CVE-2026-3210 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Mar 17, 2026A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthCVE-2026-3564 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Critical 9
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
Product
ScreenConnect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record connectwise.com
Mar 5, 2026Unnecessary transmission of sensitive cryptographic material.CVE-2026-28714 · Other software · Acronis · reported by security@acronis.comMedium 4.8
Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Product
Acronis Cyber Protect 17
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Feb 27, 2026Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), thCVE-2026-1442 · Other software · Unitree · reported by cve@takeonme.orgHigh 7.8
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
Product
UPK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record takeonme.org github.com
Jan 23, 2026Materialis Companion: Missing AuthorizationCVE-2026-24543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.
Product
Materialis Companion
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 20, 2026Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables dCVE-2025-58741 · Other software · Milner · reported by 57dba5dd-1a03-47f6-8b36-e84e47d335d8High 8.5
Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables database access.This issue affects ImageDirector Capture: from 7.0.9 through 7.6.3.25808.
Product
ImageDirector Capture
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sra.io
Jan 1, 2026A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/CVE-2025-11157 · Other software · feast-dev · reported by security@huntr.devHigh 7.8
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability arises from the use of `yaml.load(..., Loader=yaml.Loader)` to deserialize `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml`. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability to modify these YAML files to execute OS commands on the worker pod. This vulnerability can be exploited before the configuration is validated, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage.
Product
feast-dev/feast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Oct 22, 2025Material Design Iconic Font Integration: Stored Cross-Site ScriptingCVE-2025-11872 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Material Design Iconic Font Integration
Affected
up to 2
What to do
Affects up to 2. Update Material Design Iconic Font Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 5, 2025ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class.CVE-2025-8406 · Other software · zenml-io · reported by security@huntr.devHigh 7.8
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
Product
zenml-io/zenml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Oct 1, 2025In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable toCVE-2025-52039 · Other software · Frappe · reported by MITREHigh 8.2
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter.
Product
Erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 30, 2025Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via APCVE-2025-24525 · Other software · Keysight · reported by ics-cert@hq.dhs.govHigh 8.7
Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, released on September 23, 2025.
Product
Ixia Vision Product Family
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ixiacom.com support.ixiacom.com
Sep 19, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/wwCVE-2025-34206 · Other software · Vasion · reported by VulnCheckCritical 9.3
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in .secrets, MySQL client keys, and application session files are accessible from multiple containers. An attacker who controls or reaches any container can read or modify these artifacts, leading to credential theft, RCE via Laravel APP_KEY, Portainer takeover, and full compromise.
Product
Print Virtual Appliance Host
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.printerlogic.com help.printerlogic.com
Sep 9, 2025Material Dashboard: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-32486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
Product
Material Dashboard
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53012 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53011 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53010 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53009 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 15, 2025Vulnerability in the Oracle Database Materialized View component of Oracle Database Server.CVE-2025-50066 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 2.7
Vulnerability in the Oracle Database Materialized View component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_REDEFINITION privilege with network access via Oracle Net to compromise Oracle Database Materialized View. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Materialized View accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Product
Oracle Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jun 23, 2025Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.CVE-2025-23049 · Other software · Materialise · reported by MITREHigh 8.4
Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.
Product
OrthoView
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outurnate.com materialise.com
Apr 11, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31014 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowCVE-2025-0539 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.9
In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com
Apr 1, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31097 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Material Dashboard: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.CVE-2025-3061 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.6
Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.
Product
Material Admin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Mar 24, 2025Contact Form 7 Material Design: Cross-Site Request Forgery (CSRF)CVE-2025-30522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.
Product
Contact Form 7 Material Design
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Material Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 12, 2025LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.CVE-2024-56938 · Other software · Learndash · reported by MITREMedium 5.4
LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.
Product
Learndash
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 24, 2024Material Design Icons: Stored Cross-Site ScriptingCVE-2024-9024 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versions up to, and including, 0.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Material Design Icons
Affected
up to 0.0.5
What to do
Affects up to 0.0.5. Update Material Design Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems.CVE-2024-39909 · Other software · openclarity · reported by GitHubMedium 6.5
KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.
Product
kubeclarity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024Materialis: Limited arbitrary options updatesCVE-2023-3204 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to modify any option on the site to a numerical value.
Product
Materialis
Affected
up to 1.1.24
What to do
Affects up to 1.1.24. Update Materialis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 6, 2024Materialis Companion: Stored Cross-Site ScriptingCVE-2024-4707 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Materialis Companion
Affected
up to 1.3.41
What to do
Affects up to 1.3.41. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 3, 2024Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.CVE-2023-43542 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.qualcomm.com docs.qualcomm.com
Mar 14, 2024zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py.CVE-2024-28424 · Other software · zenml · reported by MITREHigh 8.8
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
Product
zenml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 21, 2024Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis.CVE-2024-23346 · Other software · materialsproject · reported by GitHubCritical 9.3
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Product
pymatgen
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 12, 2024SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an CVE-2024-24741 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact to integrity and availability.
Product
SAP Master Data Governance Material
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com sap.com
Feb 8, 2024Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer.CVE-2024-0985 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.
Product
Postgresql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org saites.dev
Feb 1, 2024An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023.CVE-2023-6078 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.8
An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution.
Product
BIOVIA Materials Studio products
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com 3ds.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.