Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

4,103 results · page 20 of 83

Feb 17, 2026lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password.CVE-2025-70846 · Other software · reported by MITREHigh 7.1
lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) on the /tools/Password/add page in the input field password.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 17, 2026Custom Content by Country (by Shield Security): Missing AuthorizationCVE-2022-41650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Country (by Shield Security): from n/a through 3.1.2.
Product
Custom Content by Country (by Shield Security)
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Custom Content by Country (by Shield Security) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer The curr_xfer field CVE-2026-23202 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer The curr_xfer field is read by the IRQ handler without holding the lock to check if a transfer is in progress. When clearing curr_xfer in the combined sequence transfer loop, protect it with the spinlock to prevent a race with the interrupt handler. Protect the curr_xfer clearing at the exit path of tegra_qspi_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field. Without this protection, the IRQ handler could read a partially updated curr_xfer value, leading to NULL pointer dereference or use-after-free.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 12, 2026GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application.CVE-2019-25339 · Other software · ghia-camip · reported by VulnCheckMedium 6.7
GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application. Attackers can paste a 33-character buffer of repeated characters into the password field to trigger an application crash on iOS devices.
Product
GHIA CamIP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record apps.apple.com exploit-db.com
Feb 12, 2026XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application.CVE-2019-25328 · Other software · XnSoft · reported by VulnCheckMedium 6.7
XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger an application crash.
Product
XnConvert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Feb 12, 2026Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code.CVE-2019-25327 · Other software · Mersenne Research, Inc · reported by VulnCheckHigh 8.4
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy host fields to trigger a bind shell on port 3110.
Product
Prime95
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com mersenne.org
Feb 12, 2026lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly sanitized or escaped.CVE-2025-70845 · Other software · reported by MITREMedium 6.1
lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly sanitized or escaped.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 12, 2026Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: tCVE-2025-69634 · Other software · reported by MITRECritical 9
Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 11, 2026SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37212 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor SpotMSN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field.CVE-2020-37211 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor SpotIM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotFTP 3.0.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37209 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotFTP 3.0.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor SpotFTP FTP Password Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotFTP 3.0.0.0 contains a buffer overflow vulnerability in the registration key input field that allows attackers to crash the application.CVE-2020-37208 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotFTP 3.0.0.0 contains a buffer overflow vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash and denial of service.
Product
Nsauditor SpotFTP FTP Password Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotDialup 1.6.7 contains a denial of service vulnerability in the registration key input field that allows attackers to crash the application.CVE-2020-37207 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration key input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
Product
Nsauditor SpotDialup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026RemShutdown 2.9.0.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' registration field.CVE-2020-37205 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
RemShutdown 2.9.0.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' registration field. Attackers can generate a 1000-character buffer payload and paste it into the registration name field to trigger an application crash.
Product
Nsauditor RemShutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input fieldCVE-2020-37197 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Dnss Domain Name Search Software contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character buffer payload and paste it into the registration name field to trigger an application crash.
Product
Nsauditor Dnss Domain Name Search Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026BlueAuditor 1.7.2.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37195 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
BlueAuditor 1.7.2.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Product
BlueAuditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Top Password Firefox Password Recovery 2.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fieldsCVE-2020-37190 · Other software · Top Password Software · reported by VulnCheckMedium 4.6
Top Password Firefox Password Recovery 2.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting 5000 characters into the User Name or Registration Code input fields.
Product
Top Password Firefox Password Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com top-password.com
Feb 11, 2026TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application.CVE-2020-37189 · Other software · DigitalVolcano Software · reported by VulnCheckMedium 4.6
TaskCanvas 1.4.0 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the registration field to trigger an application crash.
Product
TaskCanvas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalvolcano.co.uk digitalvolcano.co.uk
Feb 11, 2026SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37188 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can overwrite the buffer by pasting 1000 'A' characters into the 'Name' field, causing the application to become unresponsive.
Product
Nsauditor SpotOutlook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37187 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
SpotDialup 1.6.7 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Name' field to trigger an application crash.
Product
Nsauditor SpotDialup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field.CVE-2020-37185 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Backup Key Recovery 2.2.5 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash.
Product
Nsauditor Backup Key Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name input field that allows attackers to execute arbitrary code.CVE-2020-37184 · Other software · Allok Soft · reported by VulnCheckHigh 8.4
Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name input field that allows attackers to execute arbitrary code. Attackers can craft a specially designed payload to overwrite SEH handlers and execute system commands by injecting malicious bytecode into the input field.
Product
Allok Video Converter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alloksoft.com exploit-db.com
Feb 11, 2026APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field.CVE-2020-37179 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash.
Product
Nsauditor APKF Product Key Finder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 11, 2026P2PWIFICAM2 for iOS 10.4.1 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the Camera ID input field.CVE-2020-37175 · Other software · Ka Ming Cheung · reported by VulnCheckMedium 4.6
P2PWIFICAM2 for iOS 10.4.1 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the Camera ID input field. Attackers can paste a 257-character buffer into the Camera ID field to trigger an application crash on iOS devices.
Product
P2PWIFICAM2 for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.cnet.com exploit-db.com
Feb 9, 2026Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and tCVE-2026-22904 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.
Product
0852-1322
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com
Feb 6, 2026AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application.CVE-2020-37166 · Other software · Celestial Software · reported by VulnCheckMedium 6.9
AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.
Product
AbsoluteTelnet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record celestialsoftware.net exploit-db.com
Feb 6, 2026Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized inpCVE-2020-37155 · Other software · Core FTP · reported by VulnCheckMedium 6.7
Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction.
Product
Core FTP Lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coreftp.com exploit-db.com
Feb 6, 2026aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with aCVE-2020-37109 · Other software · asc Applied Software Consultants · reported by VulnCheckMedium 6.7
aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with a large buffer. Attackers can generate a 1000-character buffer and paste it into the Subject title to trigger an application crash and potential instability.
Product
aSc TimeTables
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asctimetables.com exploit-db.com
Feb 6, 2026Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer.CVE-2020-37107 · Other software · Core FTP · reported by VulnCheckMedium 6.7
Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer. Attackers can create a text file with 20,000 repeated characters and paste it into the account field to cause the application to become unresponsive and require reinstallation.
Product
Core FTP LE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coreftp.com coreftp.com
Feb 6, 2026Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosureCVE-2026-21626 · Other software · Stackideas.com · reported by security@joomla.orgCritical 9.2
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
Product
EasyDiscuss extension for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stackideas.com
Feb 5, 2026During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handCVE-2025-68121 · Other software · Go standard library · reported by security@golang.orgCritical 10
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.
Product
crypto/tls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record go.dev go.dev
Feb 5, 2026ZOC Terminal 7.25.5 contains a denial of service vulnerability in the private key file input field that allows attackers to crash the application.CVE-2020-37136 · Other software · EmTec · reported by VulnCheckMedium 6.7
ZOC Terminal 7.25.5 contains a denial of service vulnerability in the private key file input field that allows attackers to crash the application. Attackers can overwrite the private key file input with a 2000-byte buffer, causing the application to become unresponsive when attempting to create SSH key files.
Product
ZOC Terminal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record emtec.com exploit-db.com
Feb 5, 2026UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application.CVE-2020-37133 · Other software · UltraVNC Team · reported by VulnCheckMedium 6.7
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application. Attackers can paste an overly long string of 300 characters into the Repeater Host property to trigger an application crash.
Product
UltraVNC Launcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com uvnc.com
Feb 5, 2026Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application.CVE-2020-37130 · Other software · Nsauditor · reported by VulnCheckMedium 6.7
Nsauditor 3.2.0.0 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can create a malicious payload of 1000 bytes of repeated characters to trigger an application crash when pasted into the registration name field.
Product
Nsauditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Feb 5, 2026Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception HandCVE-2020-37120 · Other software · Rubo Medical Imaging · reported by VulnCheckHigh 8.4
Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious text file with carefully constructed payload to execute arbitrary code by overwriting SEH and triggering remote code execution.
Product
Rubo DICOM Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event basCVE-2026-23088 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: ~# cd /sys/kernel/tracing ~# echo 's:stack unsigned long stack[];' > dynamic_events ~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack"). ~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events ~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger ~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger The above makes
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the siCVE-2025-71195 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault: tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[121
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 4, 2026A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L.CVE-2025-70545 · Other software · Belden · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.
Product
PPC 2k05x Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2026A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx.CVE-2026-24512 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
Product
ingress-nginx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2026HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability.CVE-2025-52623 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.CVE-2025-65924 · Other software · Frappe · reported by MITREMedium 4.1
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable links into an ERP-generated PDF. Since PDF files generated by the ERP system are generally considered trustworthy, users are highly likely to click these links, potentially enabling phishing attacks or malware delivery. This issue occurs in the Add Quality Goal' function.
Product
Erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 3, 2026Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section.CVE-2019-25265 · Other software · Bigprof · reported by VulnCheckMedium 5.1
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.
Product
Online Inventory Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bigprof.com bigprof.com
Feb 1, 2026Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields.CVE-2021-47911 · Other software · jdwebdesigner · reported by VulnCheckMedium 4.8
Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields. Attackers can inject malicious scripts through fullname, username, and email parameters to execute client-side attacks and manipulate browser requests.
Product
Affiliate Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codecanyon.net jdwebdesigner.com
Feb 1, 2026Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields.CVE-2021-47885 · Other software · CriticalGears · reported by VulnCheckMedium 5.1
Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields. Attackers can inject malicious script code through vulnerable parameters to manipulate client-side requests and potentially execute session hijacking or phishing attacks.
Product
PayPal PRO Payment Terminal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record criticalgears.com criticalgears.com
Jan 30, 2026Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code.CVE-2020-37049 · Other software · WinFrigate · reported by VulnCheckHigh 8.4
Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload to overflow the buffer, bypass DEP, and execute commands like launching calc.exe through a specially crafted input sequence.
Product
Frigate 3 Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Jan 30, 2026Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field.CVE-2020-37038 · Other software · Code::Blocks · reported by VulnCheckMedium 4.6
Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field. Attackers can paste a large payload of 5000 repeated characters into the search field to trigger an application crash.
Product
Code::Blocks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeblocks.org sourceforge.net
Jan 30, 2026Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to eCVE-2020-37028 · Other software · SOCUSOFT · reported by VulnCheckHigh 8.4
Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the output folder field to trigger a stack-based buffer overflow and potentially execute shellcode.
Product
Photo to Video Converter Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Jan 30, 2026NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode.CVE-2019-25232 · Other software · NetPCLinker · reported by VulnCheckHigh 8.4
NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode. Attackers can craft a malicious payload in the DNS/IP input to overwrite SEH handlers and execute shellcode when adding a new client.
Product
NetPCLinker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sourceforge.net exploit-db.com
Jan 29, 2026QlikView 12.50.20000.0 contains a denial of service vulnerability in the FTP server address input field that allows local attackers to crash the application.CVE-2020-36994 · Other software · QlikTech International AB · reported by VulnCheckMedium 4.6
QlikView 12.50.20000.0 contains a denial of service vulnerability in the FTP server address input field that allows local attackers to crash the application. Attackers can paste a 300-character buffer into the FTP server address field to trigger an application crash and prevent normal functionality.
Product
QlikView
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com qlik.com
Jan 28, 2026docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memoCVE-2020-36965 · Other software · VeryPDF.com, Inc. · reported by VulnCheckHigh 8.4
docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload that triggers a structured exception handler (SEH) overwrite to execute shellcode and gain remote system access.
Product
docPrint Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record verypdf.com exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.