Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
642 results · page 3 of 13
Jun 3, 2026Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability.CVE-2026-36460 · Other software · reported by MITREMedium 4.8
Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovestones.comgist.github.com
Jun 1, 2026eLabFTW is an open source electronic lab notebook.CVE-2026-28511 · Other software · elabftw · reported by GitHubMedium 4.3
eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue. # Affected Scope Cross-scope visibility of titles. No confirmed bypass of content-level access controls # Preconditions An authenticated user account No special privileges required beyond standard access # Impact This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleCVE-2026-49384 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
- Product
- PyCharm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Facebook for WooCommerce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-49059 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCommerce: from n/a through 3.7.0.
- Product
- Facebook for WooCommerce
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Notebook Pro 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the CVE-2018-25378 · Other software · Stokedonit · reported by VulnCheckMedium 6.9
Notebook Pro 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the notebook name field. Attackers can create a malicious text file containing 500 or more characters, paste the content into the New Notebook Name field, and trigger an application crash when attempting to create and save the notebook.
- Product
- Notebook Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
May 22, 2026JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks.CVE-2026-40864 · Other software · jupyterhub · reported by GitHubMedium 5.4
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.
- Product
- jupyterhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.CVE-2026-34600 · Other software · laurent22 · reported by GitHubMedium 5.7
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289. In ChangeModel.delta, when DELTA_INCLUDES_ITEMS is enabled (the default), the latest state of items is attached to delta output without verifying that those items are still shared with the requesting user, and the existing removal logic only filters items deleted for all users. Additionally, the change compression logic incorrectly reduces create - delete to NOOP, which is unsafe because compression is applied per page and an item can have multiple create events; if an earlier create falls on a separate page from a later create -> delete pair, the deletion is dropped and the sequence collapses to a create. As a result, the delta API returns a create event for a deleted item with the full latest content attached, exposing notes the user no longer has access to. This issue has been fixed in version 3.5.3.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.CVE-2025-57798 · Other software · laurent22 · reported by GitHubMedium 5.5
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.CVE-2026-22810 · Other software · laurent22 · reported by GitHubHigh 8.2
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.
- Product
- joplin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.CVE-2026-42557 · Other software · jupyterlab · reported by GitHubHigh 8.6
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.CVE-2026-42266 · Other software · jupyterlab · reported by GitHubHigh 8.8
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint.CVE-2026-31231 · Other software · reported by MITRECritical 9.8
Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint. The endpoint is designed to execute arbitrary Python code provided by the user, but it does so using the unsafe exec() function without any sandboxing, validation, or security controls. An attacker can exploit this by sending a specially crafted POST request containing malicious Python code to the execution endpoint. This leads to arbitrary code execution on the Cognee server with the privileges of the server process, allowing complete compromise of the system.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal seCVE-2026-8034 · Other software · GitHub · reported by product-cna@github.comHigh 7.9
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
May 7, 2026Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the dockerCVE-2026-33589 · Other software · Open Notebook · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.2
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.
- Product
- Open Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker contaCVE-2026-33588 · Other software · Open Notebook · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.
- Product
- Open Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker containeCVE-2026-33587 · Other software · Open Notebook · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.2
Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations.
- Product
- Open Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimateCVE-2026-28201 · Other software · Open Notebook · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.
- Product
- Open Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/CVE-2026-40171 · Other software · jupyter · reported by GitHubHigh 8.4
In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click. An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.
- Product
- notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026eLabFTW is an open source electronic lab notebook.CVE-2026-28510 · Other software · elabftw · reported by GitHubMedium 5.9
eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2.CVE-2026-7810 · Other software · UsamaK98 · reported by VulDBMedium 5.5
A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function create_notebook/read_notebook/edit_cell/add_cell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- python-notebook-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.CVE-2026-23866 · Other software · Facebook · reported by cve-assign@fb.comMedium 4.3
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
- Product
- WhatsApp for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comwhatsapp.com
May 1, 2026An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytCVE-2026-23863 · Other software · Facebook · reported by cve-assign@fb.comMedium 6.5
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
- Product
- WhatsApp Desktop for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comwhatsapp.com
Apr 21, 2026Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endCVE-2026-31013 · Other software · Dovestones · reported by MITREMedium 6.1
Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.
- Product
- AD Phonebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddovestones.comgist.github.com
Apr 20, 2026The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.CVE-2026-39378 · Other software · jupyter · reported by GitHubMedium 6.5
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.
- Product
- nbconvert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.CVE-2026-39377 · Other software · jupyter · reported by GitHubMedium 6.5
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
- Product
- nbconvert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.
- Product
- TrueBooker
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2026JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks.CVE-2026-33709 · Other software · jupyterhub · reported by GitHubMedium 5.1
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
- Product
- jupyterhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Appointment Booking and Scheduler Plugin – Truebooker: Sensitive Information ExposureCVE-2026-1797 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.
- Product
- Appointment Booking and Scheduler Plugin – Truebooker
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Appointment Booking and Scheduler Plugin – Truebooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 24, 2026PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHPCVE-2019-25647 · Other software · Phreesoft · reported by VulnCheckHigh 8.7
PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.
- Product
- PhreeBooks ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Mar 24, 2026PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious fileCVE-2019-25630 · Other software · Phreesoft · reported by VulnCheckHigh 8.7
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.
- Product
- PhreeBooks ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Mar 11, 2026Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files.CVE-2025-70330 · Other software · reported by MITRELow 3.3
Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets within an otherwise valid .EGP file, an attacker can trigger an out-of-bounds memory read during parsing. This results in an unhandled access violation and application crash, leading to a local denial-of-service condition when the crafted file is opened by a user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.CVE-2026-1960 · Other software · Loggro Pymes · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/ConsultaTerceros' endpoint.
- Product
- Loggro Pymes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution.CVE-2021-47904 · Other software · Phreesoft · reported by VulnCheckHigh 8.7
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.
- Product
- PhreeBooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comexploit-db.com
Jan 14, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored CVE-2025-14557 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comherodevs.com
Jan 5, 2026AweBooking: Insertion of Sensitive Information Into Sent DataCVE-2025-68014 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through <= 3.2.26.
- Product
- AweBooking
- Affected
- up to 3.2.26
- What to do
- Affects up to 3.2.26. Update AweBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.CVE-2025-53000 · Other software · jupyter · reported by GitHubHigh 8.5
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.
- Product
- nbconvert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025TrueBooker: Missing AuthorizationCVE-2025-67581 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
- Product
- TrueBooker
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2025Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing eveCVE-2025-55181 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Nov 20, 2025Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook.CVE-2025-63848 · Other software · Swi-prolog · reported by MITREMedium 6.1
Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook.
- Product
- Swish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.8CVE-2025-55179 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.4
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
- Product
- WhatsApp Business for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comwhatsapp.com
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
- Product
- Facebook for WooCommerce
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 27, 2025eLabFTW is an open source electronic lab notebook for research labs.CVE-2025-62793 · Other software · elabftw · reported by GitHubMedium 6.8
eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verificatCVE-2025-11577 · Other software · Clevo · reported by cret@cert.orgHigh 7.6
Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.
- Product
- Notebook System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.CVE-2025-59842 · Other software · jupyterlab · reported by GitHubLow 2.1
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025Nextend Facebook Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
- Product
- Nextend Facebook Connect
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Nextend Facebook Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2025A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebookCVE-2025-8061 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected. This vulnerability does not affect systems when the Windows feature Core Isolation Memory Integrity is enabled. Lenovo systems preloaded with Windows 11 have this feature enabled by default.
- Product
- Dispatcher 3.0 Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2025Ebook Store: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8113 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Ebook Store
- Fixed in
- 5.8015
- What to do
- Update Ebook Store to 5.8015 or newer.
Aug 14, 2025Ebook Store: Cross-Site Request Forgery (CSRF)CVE-2025-54702 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store ebook-store allows Cross Site Request Forgery.This issue affects Ebook Store: from n/a through <= 5.8013.
- Product
- Ebook Store
- Affected
- up to 5.8013
- What to do
- Affects up to 5.8013. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025TheBooking: Missing AuthorizationCVE-2025-52801 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.
- Product
- TheBooking
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update TheBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2025Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database.CVE-2025-55165 · Other software · gelbphoenix · reported by GitHubHigh 8.2
Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
- Product
- autocaliweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.