Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
474 results · page 2 of 10
Jun 10, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
- Product
- WPZOOM Portfolio
- Affected
- up to 1.4.21
- What to do
- Affects up to 1.4.21. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 13, 2026Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via CVE-2026-30906 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to condCVE-2026-30905 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical CVE-2026-30904 · Other software · Zoom Communications · reported by security@zoom.usLow 1.8
Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026iZooto: Missing AuthorizationCVE-2026-39673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.
- Product
- iZooto
- Affected
- up to 3.7.20
- What to do
- Affects up to 3.7.20. Update iZooto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Video Conferencing with Zoom: Missing AuthorizationCVE-2026-39653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2026The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state.CVE-2026-3777 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost vCVE-2026-3109 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.2
Mattermost Plugins versions <=11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Social Icons Widget & Block by WPZOOM: Unauthorized data modificationCVE-2026-4063 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.
- Product
- Social Icons Widget & Block by WPZOOM
- Affected
- up to 4.5.8
- What to do
- Affects up to 4.5.8. Update Social Icons Widget & Block by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2026External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation CVE-2026-30903 · Other software · Zoom Communications · reported by security@zoom.usCritical 9.6
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2026-30902 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.8
Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local aCVE-2026-30901 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7
Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilCVE-2026-30900 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.8
Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stCVE-2026-24308 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Mar 7, 2026Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PCVE-2026-24281 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.4
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Mar 6, 2026BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through tCVE-2018-25163 · Other software · Bitzoom · reported by VulnCheckHigh 8.8
BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rollno and username parameters in forgot.php and login.php. Attackers can submit crafted POST requests with SQL UNION statements to extract database schema information and table contents from the application database.
- Product
- BitZoom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 5, 2026LBG Zoominoutslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28103 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows Reflected XSS.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.5.
- Product
- LBG Zoominoutslider
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update LBG Zoominoutslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026Video Conferencing with Zoom: Contains an AJAX handler that has its nonce verification commented outCVE-2026-1368 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.6.6
- What to do
- Update Video Conferencing with Zoom to 4.6.6 or newer.
Feb 16, 2026Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post CVE-2026-0998 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user CVE-2026-0997 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2026ZoomifyWP Free: Stored Cross-Site ScriptingCVE-2026-1187 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ZoomifyWP Free
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update ZoomifyWP Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2026WPZOOM Addons for Elementor – Starter Templates & Widgets: Unauthorized access of dataCVE-2026-2295 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.
- Product
- WPZOOM Addons for Elementor – Starter Templates & Widgets
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update WPZOOM Addons for Elementor – Starter Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 20, 2026A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code executCVE-2026-22844 · Other software · Zoom Communications Inc. · reported by security@zoom.usCritical 9.9
A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
- Product
- Zoom Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025ZoomSounds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47566 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through 6.91.
- Product
- ZoomSounds
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025LBG Zoominoutslider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68056 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.4.
- Product
- LBG Zoominoutslider
- Affected
- up to 5.4.4
- What to do
- Affects up to 5.4.4. Update LBG Zoominoutslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WPZOOM Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addons allows DOM-Based XSS.This issue affects WPZOOM Addons for Elementor: from n/a through <= 1.2.10.
- Product
- WPZOOM Addons for Elementor
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update WPZOOM Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2025External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via loCVE-2025-67461 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5
External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilegCVE-2025-67460 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.8
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of CVE-2025-62484 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via CVE-2025-64741 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalaCVE-2025-64740 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.5
Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2025-64739 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information vCVE-2025-64738 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5
External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.
- Product
- Zoom Workplace for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of informationCVE-2025-62483 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5.3
Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.CVE-2025-62482 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.CVE-2025-30669 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.8
Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective traCVE-2025-30662 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 6.6
Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace VDI Plugin macOS Universal installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams: Exposure of sensitive informationCVE-2025-11760 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access.
- Product
- eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2025Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network accesCVE-2025-58133 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5.3
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access.CVE-2025-58132 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.1
Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.CVE-2025-58457 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)
- Product
- Apache ZooKeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 9, 2025Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network aCVE-2025-58135 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 5.3
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access.CVE-2025-58134 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access.
- Product
- Zoom Workplace Clients for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respectCVE-2025-58131 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.6
Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respective tracks) may allow an authenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-49461 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-49460 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.3
Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of prCVE-2025-49459 · Other software · Zoom Communications, Inc · reported by security@zoom.usHigh 7.8
Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace for Windows on ARM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access.CVE-2025-49458 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.CVE-2025-35452 · Other software · PTZOptics · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
- Product
- PT12X-SE-xx-G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials.CVE-2025-35451 · Other software · PTZOptics · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
- Product
- PT12X-SE-xx-G3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.