Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
204 results · page 2 of 5
Jun 22, 2026launch-editor allows users to open files with line numbers in editor from Node.js.CVE-2026-53632 · Other software · vitejs · reported by GitHubMedium 5.5
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
- Product
- launch-editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-53571 · Other software · vitejs · reported by GitHubHigh 8.2
Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Vitepos: Does not properly restrict the roles that can be assignedCVE-2026-8157 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
- Product
- Vitepos
- Fixed in
- 3.4.2
- What to do
- Update Vitepos to 3.4.2 or newer.
Jun 12, 2026Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInviCVE-2026-6689 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatCVE-2026-50636 · Other software · LimeSurvey · reported by VulnCheckHigh 8.7
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL injection. Because LimeSurvey configures its PDO connection with emulated prepared statements (emulatePrepare = true) and does not disable MySQL multi-statements, the injection supports stacked queries: the attacker can append arbitrary additional statements (INSERT/UPDATE/DELETE/DROP/CREATE) after the original SELECT. This permits both arbitrary read of any data in the database, such as administrator bcrypt password hashes (lime_users), survey response PII, session records, and global settings, all recoverable via a SLEEP() time-based blind oracle, and arbitrary write/destruction of that data, including directly overwriting the administrator password hash for immediate account takeover or dropping/truncating tables. Reads and writes extend to any schema the application's database user can a
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlimesurvey.org
Jun 1, 2026launch-editor allows users to open files with line numbers in editor from Node.js.CVE-2024-52011 · Other software · vitejs · reported by GitHubHigh 7.5
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
- Product
- launch-editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster CVE-2026-4273 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Vite+ is a unified toolchain and entry point for web development.CVE-2026-41211 · Other software · voidzero-dev · reported by GitHubHigh 8.4
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to escape the `VP_HOME/package_manager/<pm>/` cache root and make Vite+ delete, replace, and populate directories outside the intended cache location. Version 0.1.17 contains a patch.
- Product
- vite-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39365 · Other software · vitejs · reported by GitHubMedium 6.3
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39364 · Other software · vitejs · reported by GitHubHigh 8.2
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 7, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-39363 · Other software · vitejs · reported by GitHubHigh 8.2
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 1, 2026Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go.CVE-2026-34456 · Other software · reviactyl · reported by GitHubCritical 9.1
Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim’s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bCVE-2026-2463 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.. Mattermost Advisory ID: MMSA-2025-00565
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2026-27969 · Other software · vitessio · reported by GitHubCritical 9.3
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2026-27965 · Other software · vitessio · reported by GitHubHigh 8.4
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissioCVE-2025-14573 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.8
Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 bCVE-2026-0944 · Websites & servers · reported by mlhess@drupal.orgMedium 5.3
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all vCVE-2025-15542 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.3
Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causing a denial of service on incoming calls.
- Product
- VX800v v1.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Jan 22, 2026ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-0792 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Alert-Info header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28301.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-0791 · Other software · ALGO · reported by zdi-disclosures@trendmicro.comCritical 9.8
ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Replaces header of SIP INVITE requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28300.
- Product
- 8180 IP Audio Alerter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) pCVE-2025-13324 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.CVE-2025-68155 · Other software · vitejs · reported by GitHubHigh 7.5
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter. Version 0.5.8 fixes the issue.
- Product
- vite-plugin-react
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.CVE-2025-67489 · Other software · vitejs · reported by GitHubCritical 9.8
@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.
- Product
- vite-plugin-react
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
- Product
- Gravitec.net – Web Push Notifications
- Affected
- up to 2.9.17
- What to do
- Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025Kivitendo before 3.9.2 allows XXE injection.CVE-2025-66370 · Other software · kivitendo · reported by MITREMedium 5
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
- Product
- kivitendo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.kivitendo.degithub.com
Nov 26, 2025Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.CVE-2025-65672 · Other software · Classroomio · reported by MITREHigh 7.5
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
- Product
- Classroomio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Vitepos – Point of Sale (POS) for WooCommerce: Arbitrary file uploadsCVE-2025-13156 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
- Product
- Vitepos – Point of Sale (POS) for WooCommerce
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Vitepos – Point of Sale (POS) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2025In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability.CVE-2025-54320 · Other software · Ascertia · reported by MITREMedium 4.3
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comascertia.com
Oct 20, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-62522 · Other software · vitejs · reported by GitHubMedium 6
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime.CVE-2025-59427 · Other software · cloudflare · reported by GitHubLow 2.9
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as .env and .dev.vars. This vulnerability is fixed in 1.6.0.
- Product
- workers-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-58752 · Other software · vitejs · reported by GitHubLow 2.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Vite is a frontend tooling framework for JavaScript.CVE-2025-58751 · Other software · vitejs · reported by GitHubLow 2.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support.CVE-2025-57753 · Network & remote access · sapphi-red · reported by GitHubMedium 6
vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.
- Product
- vite-plugin-static-copy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamCVE-2025-47870 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite CVE-2025-6227 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.2
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality.CVE-2025-4687 · Other software · Teltonika Networks · reported by 001d69cf-3fc9-4203-93fb-9865b54e05b2High 7.2
In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7.
- Product
- RMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025WP Discord Invite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47638 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.
- Product
- WP Discord Invite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Discord Invite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 3, 2025In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.CVE-2025-47245 · Other software · BlueWave · reported by MITREHigh 8.1
In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025Vite is a frontend tooling framework for javascript.CVE-2025-46565 · Other software · vitejs · reported by GitHubMedium 6
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization.CVE-2025-46552 · Other software · Krypto-Hashers-Community · reported by GitHubMedium 6.3
KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed unauthorized users to access sensitive user information by directly calling specific endpoints. This issue has been patched in a later commit on version 1.2.
- Product
- KHC-INVITATION-AUTOMATION
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-39535 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.
- Product
- Vitepos
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Vite is a frontend tooling framework for javascript.CVE-2025-32395 · Other software · vitejs · reported by GitHubMedium 6
Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025Vite Coupon: Cross-Site Request Forgery (CSRF)CVE-2025-32642 · WordPress plugins & themes · reported by PatchstackCritical 10
Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through <= 1.0.9.
- Product
- Vite Coupon
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Vite Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Vite is a frontend tooling framework for javascript.CVE-2025-31486 · Other software · vitejs · reported by GitHubMedium 5.3
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
- Product
- Vitepos
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Vite Vitejs Improper Access Control VulnerabilityCVE-2025-31125 · Other software · Vite · reported by GitHubExploitedMedium 5.3
Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
- Product
- Vitejs
- On CISA’s list since
- Jan 22, 2026 (federal fix deadline Feb 12, 2026)
- What to do
- Attackers are using this now. Install Vite’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Mar 26, 2025Secure Invites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites allows Reflected XSS.This issue affects Secure Invites: from n/a through <= 1.3.
- Product
- Secure Invites
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Secure Invites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.CVE-2025-30208 · Other software · vitejs · reported by GitHubMedium 5.3
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaiCVE-2024-9098 · Other software · lunary-ai · reported by security@huntr.devMedium 6.1
In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from inviting users with billing roles. As a result, admins can circumvent the intended access control, posing a risk to the organization's financial resources.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list.CVE-2024-12869 · Other software · infiniflow · reported by security@huntr.devMedium 4.3
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.
- Product
- infiniflow/ragflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.