Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

460 results · page 3 of 10

Aug 22, 2025WP Crontrol: Blind Server-Side Request ForgeryCVE-2025-8678 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
WP Crontrol
Affected
1.17.0 to 1.19.1
What to do
Affects 1.17.0 to 1.19.1. Update WP Crontrol to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 4, 2025A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1.CVE-2025-8535 · Other software · cronoh · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the file /main.js of the component xrb URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
NanoVault
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com gist.github.com
Jun 27, 2025Cron Logger: Missing AuthorizationCVE-2025-53266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.
Product
Cron Logger
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Cron Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2025A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script.CVE-2025-34043 · Other software · Vacron · reported by VulnCheckCritical 10
A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests. These commands are executed with the privileges of the web server process, enabling remote code execution and potential full device compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Product
Network Video Recorder (NVR)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ssd-disclosure.com vulncheck.com
Jun 4, 2025Sensitive information disclosure due to SSRF.CVE-2025-48962 · Other software · Acronis · reported by security@acronis.comMedium 4.3
Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-48961 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Weak server key used for TLS encryption.CVE-2025-48960 · Other software · Acronis · reported by security@acronis.comMedium 5.9
Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Local privilege escalation due to insecure file permissions.CVE-2025-48959 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Denial of service due to improper handling of malformed input.CVE-2025-30415 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
May 26, 2025Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A.CVE-2025-40663 · Other software · i2A · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated attacker to upload a malicious SVG image into the user's personal space in /CronosWeb/Modules/Persons/PersonalDocuments/PersonalDocuments. There is no reported fix at this time.
Product
Cronos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Advanced Cron Manager
Fixed in
2.5.7
What to do
Update Advanced Cron Manager to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Apr 24, 2025Denial of service due to allocation of resources without limits.CVE-2025-30409 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 24, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-30408 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 26, 2025Local privilege escalation due to a binary hijacking vulnerability.CVE-2025-30407 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Feb 27, 2025Arbitrary file overwrite during home directory recovery due to improper symbolic link handling.CVE-2025-24832 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to unquoted search path vulnerability.CVE-2025-24831 · Other software · Acronis · reported by security@acronis.comMedium 6.6
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24830 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24829 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24828 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24827 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 28, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-24826 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625.
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Web installer integrity check used weak hash algorithm.CVE-2024-56414 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Web installer integrity check used weak hash algorithm. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Missing session invalidation after user deletion.CVE-2024-56413 · Other software · Acronis · reported by security@acronis.comMedium 6.1
Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-55543 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Local privilege escalation due to excessive permissions assigned to Tray Monitor service.CVE-2024-55542 · Other software · Acronis · reported by security@acronis.comMedium 4.4
Local privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage.CVE-2024-55541 · Other software · Acronis · reported by security@acronis.comMedium 6.1
Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39169.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-55540 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Sensitive information disclosure due to missing authentication.CVE-2024-55538 · Other software · Acronis · reported by security@acronis.comMedium 4
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before build 42571, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis True Image
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 2, 2025Sensitive information disclosure due to insecure folder permissions.CVE-2024-49385 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis True Image
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Dec 23, 2024Weak algorithm used to sign RPM package.CVE-2024-55539 · Other software · Acronis · reported by security@acronis.comLow 2.5
Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Protect 16 (Linux) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 11, 2024Sensitive information disclosure during file browsing due to improper symbolic link handling.CVE-2024-34015 · Other software · Acronis · reported by security@acronis.comLow 3.3
Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 11, 2024Arbitrary file overwrite during recovery due to improper symbolic link handling.CVE-2024-34014 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
Product
Advanced Cron Manager – debug & control
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Stored cross-site scripting (XSS) vulnerability on enrollment invitation page.CVE-2024-49392 · Other software · Acronis · reported by security@acronis.comMedium 4.8
Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Product
Acronis Cyber Files
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 17, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-49391 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Product
Acronis Cyber Files
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 17, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-49390 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Product
Acronis Cyber Files
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 17, 2024Local privilege escalation due to insecure folder permissions.CVE-2024-49389 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Product
Acronis Cyber Files
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 17, 2024Sensitive information disclosure due to spell-jacking.CVE-2024-49386 · Other software · Acronis · reported by security@acronis.comMedium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Product
Acronis Cyber Files
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 15, 2024Sensitive information manipulation due to improper authorization.CVE-2024-49388 · Other software · Acronis · reported by security@acronis.comCritical 9.1
Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 15, 2024Cleartext transmission of sensitive information in acep-collector service.CVE-2024-49387 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 15, 2024Excessive attack surface in acep-collector service due to binding to an unrestricted IP address.CVE-2024-49384 · Other software · Acronis · reported by security@acronis.comMedium 4.3
Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 15, 2024Excessive attack surface in acep-importer service due to binding to an unrestricted IP address.CVE-2024-49383 · Other software · Acronis · reported by security@acronis.comMedium 4.3
Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Oct 15, 2024Excessive attack surface in archive-server service due to binding to an unrestricted IP address.CVE-2024-49382 · Other software · Acronis · reported by security@acronis.comMedium 4.3
Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
Product
Acronis Cyber Protect 16
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 23, 2024Local active protection service settings manipulation due to unnecessary privileges assignment.CVE-2024-8903 · Other software · Acronis · reported by security@acronis.comMedium 4.7
Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 17, 2024Sensitive data disclosure and manipulation due to unnecessary privileges assignment.CVE-2024-8767 · Other software · Acronis · reported by security@acronis.comCritical 9.9
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-8766 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-34016 · Other software · Acronis · reported by security@acronis.comMedium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 13, 2024Cron Jobs: Reflected Cross-Site ScriptingCVE-2024-8731 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Cron Jobs
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Cron Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from thCVE-2024-42642 · Other software · Crucial · reported by MITREMedium 6.7
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.
Product
Mx500 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com crucial.com
Aug 29, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-34019 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569.
Product
Acronis Snap Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.