Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
143 results · page 2 of 3
Mar 26, 2026Ech0 is an open-source, self-hosted publishing platform for personal idea sharing.CVE-2026-33638 · Other software · lin-snow · reported by GitHubMedium 5.3
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.
- Product
- Ech0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicCVE-2018-25182 · Other software · Snowhall · reported by VulnCheckHigh 8.8
Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the ID parameter. Attackers can send GET requests to wcategory.php with crafted SQL payloads in the ID parameter to extract database table names and sensitive information from the database.
- Product
- Silurus Classifieds Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 4, 2026An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read anCVE-2025-66678 · Other software · Faintsnow · reported by MITRECritical 9.8
An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read and write operations via a crafted request.
- Product
- Hardware Read & Write Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1.CVE-2026-3293 · Other software · snowflakedb · reported by VulDBLow 1.9
A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.
- Product
- snowflake-jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Snow Monkey Forms: Arbitrary file deletionCVE-2026-1056 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Snow Monkey Forms
- Affected
- up to 12.0.3
- What to do
- Affects up to 12.0.3. Update Snow Monkey Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2026Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules).CVE-2026-24804 · Other software · coolsnowwolf · reported by cve_disclosure@tech.gov.sgCritical 9.2
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.
- Product
- lede
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modulesCVE-2026-24803 · Other software · coolsnowwolf · reported by cve_disclosure@tech.gov.sgCritical 9.2
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.
- Product
- lede
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Snow Mountain: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69065 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through <= 1.4.3.
- Product
- Snow Mountain
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Snow Mountain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2025When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the sCVE-2025-3717 · Other software · Grafana Labs · reported by security@grafana.comLow 2.1
When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
- Product
- Grafana Snowflake Datasource Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025WP Snow Effect: Missing AuthorizationCVE-2025-64294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Snow Effect: from n/a through <= 1.1.19.
- Product
- WP Snow Effect
- Affected
- up to 1.1.19
- What to do
- Affects up to 1.1.19. Update WP Snow Effect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Snow Monkey: Server-Side Request ForgeryCVE-2025-10137 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Snow Monkey
- Affected
- up to 29.1.5
- What to do
- Affects up to 29.1.5. Update Snow Monkey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2025git-commiters is a Node.js function module providing committers stats for their git repository.CVE-2025-59831 · Other software · snowyu · reported by GitHubHigh 8.7
git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.
- Product
- git-commiters.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.CVE-2024-58265 · Other software · mcginty · reported by MITRELow 3.1
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
- Product
- snow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.CVE-2025-50213 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Product
- Apache Airflow Providers Snowflake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 29, 2025libsnowflakeclient is the Snowflake Connector for C/C++.CVE-2025-46330 · Other software · snowflakedb · reported by GitHubLow 3.3
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTTP response status code 400, as able to be retried. This could hang the application until SF_CON_MAX_RETRY requests were sent. This issue has been patched in version 2.2.0.
- Product
- libsnowflakeclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025libsnowflakeclient is the Snowflake Connector for C/C++.CVE-2025-46329 · Other software · snowflakedb · reported by GitHubLow 3.3
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0.
- Product
- libsnowflakeclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025snowflake-connector-nodejs is a NodeJS driver for Snowflake.CVE-2025-46328 · Other software · snowflakedb · reported by GitHubLow 3.3
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 2.0.4.
- Product
- snowflake-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025gosnowflake is the Snowflake Golang driver.CVE-2025-46327 · Other software · snowflakedb · reported by GitHubLow 3.3
gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3.
- Product
- gosnowflake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025snowflake-connector-net is the Snowflake Connector for .NET.CVE-2025-46326 · Other software · snowflakedb · reported by GitHubLow 3.3
snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads logging configuration from a user-provided file. On Linux and macOS, the Connector verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Connector. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 4.4.1.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information inCVE-2025-46614 · Other software · Snowflake · reported by MITRELow 3.3
In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information into a Log File.
- Product
- Snowflake ODBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowflake.com
Apr 3, 2025This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits).CVE-2024-56528 · Other software · Snowplow · reported by MITREHigh 7.5
This vulnerability affects Snowplow Collector 3.x before 3.3.0 (unless it’s set up behind a reverse proxy that establishes payload limits). It involves sending very large payloads to the Collector and can render it unresponsive to the rest of the requests. As a result, data would not enter the pipeline and would be potentially lost.
- Product
- Stream Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue was discovered in Iglu Server 0.13.0 and below.CVE-2024-47217 · Other software · Snowplow · reported by MITREMedium 6.5
An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
- Product
- Iglu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side.CVE-2024-47215 · Other software · Snowplow · reported by MITREHigh 7.5
An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events, causing them to be retried indefinitely. As a result, the performance of forwarding events to GTM SS overall can be affected (latency, throughput).
- Product
- Snowbridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue was discovered in Iglu Server 0.13.0 and below.CVE-2024-47214 · Other software · Snowplow · reported by MITREHigh 7.5
An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payload. As above, it can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
- Product
- Iglu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue was discovered affecting Enrich 5.1.0 and below.CVE-2024-47213 · Other software · Snowplow · reported by MITREHigh 7.5
An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event and trying to validate it, Enrich crashes and attempts to restart indefinitely. As a result, event processing would be halted.
- Product
- Enrich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue was discovered in Iglu Server 0.13.0 and below.CVE-2024-47212 · Other software · Snowplow · reported by MITREHigh 7.5
An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt.
- Product
- Iglu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Snow Storm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.
- Product
- Snow Storm
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Snow Storm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands.CVE-2024-8055 · Other software · vanna-ai · reported by security@huntr.devHigh 7.5
Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as `/etc/passwd`, by exploiting the exposed SQL queries through a Python Flask API.
- Product
- vanna-ai/vanna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versioCVE-2025-27496 · Other software · snowflakedb · reported by GitHubLow 3.3
Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1.
- Product
- snowflake-jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24795 · Other software · snowflakedb · reported by GitHubMedium 4.4
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24794 · Other software · snowflakedb · reported by GitHubMedium 6.7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24793 · Other software · snowflakedb · reported by GitHubHigh 7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025snowflake-connector-net is the Snowflake Connector for .NET.CVE-2025-24788 · Other software · snowflakedb · reported by GitHubMedium 5
snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake.CVE-2025-24790 · Other software · snowflakedb · reported by GitHubMedium 4.4
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.
- Product
- snowflake-jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake.CVE-2025-24789 · Other software · snowflakedb · reported by GitHubHigh 7.8
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.
- Product
- snowflake-jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025snowflake-connector-nodejs is a NodeJS driver for Snowflake.CVE-2025-24791 · Other software · snowflakedb · reported by GitHubMedium 4.4
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
- Product
- snowflake-connector-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database.CVE-2025-24792 · Other software · snowflakedb · reported by GitHubMedium 4.4
Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.
- Product
- pdo_snowflake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executCVE-2024-11482 · Other software · Trellix · reported by trellixpsirt@trellix.comCritical 9.8
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.
- Product
- Trellix Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comhackerone.com
Nov 29, 2024A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API.CVE-2024-11481 · Other software · Trellix · reported by trellixpsirt@trellix.comHigh 8.2
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.
- Product
- Trellix Enterprise Security Manager (ESM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without thCVE-2024-43382 · Other software · snowflake · reported by MITREMedium 5.9
Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption.
- Product
- snowflake_jdbc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2024-49750 · Other software · snowflakedb · reported by GitHubMedium 5.5
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes (when specified via the `passcode` parameter) and Azure SAS tokens. Additionally, the SecretDetector logging formatter, if enabled, contained bugs which caused it to not fully redact JWT tokens and certain private key formats. Snowflake released version 3.12.3 of the Snowflake Connector for Python, which fixes the issue. In addition to upgrading, users should review their logs for any potentially sensitive information that may have been captured.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if ActCVE-2024-4129 · Other software · Snow Software AB · reported by security@snowsoftware.comHigh 8.8
Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.
- Product
- Snow License Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Mar 22, 2024SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interfacCVE-2024-25168 · Other software · qimingjin · reported by MITREMedium 6.3
SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface.
- Product
- snow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake.CVE-2024-28851 · Other software · snowflakedb · reported by GitHubMedium 4
The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.
- Product
- snowflake-hive-metastore-connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.ThCVE-2024-1150 · Other software · Snow Software · reported by security@snowsoftware.comHigh 7.8
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1.
- Product
- Inventory Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Feb 8, 2024Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow SoftwarCVE-2024-1149 · Other software · Snow Software · reported by security@snowsoftware.comHigh 7.8
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.
- Product
- Inventory Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Feb 8, 2024Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent:CVE-2023-7169 · Other software · Snow Software · reported by security@snowsoftware.comMedium 6
Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0
- Product
- Snow Inventory Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Dec 22, 2023The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications.CVE-2023-51662 · Other software · snowflakedb · reported by GitHubMedium 6
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.
- Product
- snowflake-connector-net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.snowflake.comgithub.com
Aug 11, 2023Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticatCVE-2023-3937 · Other software · Snow Software · reported by security@snowsoftware.comMedium 4.8
Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser
- Product
- Snow License Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Aug 11, 2023Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with CVE-2023-3864 · Other software · Snow Software · reported by security@snowsoftware.comHigh 7.2
Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.
- Product
- SLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowsoftware.comcommunity.snowsoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.