Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
795 results · page 3 of 16
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45311 · Other software · Hmbown · reported by GitHubCritical 9.6
CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45310 · Other software · Hmbown · reported by GitHubHigh 7.4
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as PythCVE-2026-7304 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantiproof.aigithub.com
May 18, 2026SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere tCVE-2026-7302 · Other software · SGLang · reported by cret@cert.orgCritical 9.1
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantiproof.aigithub.com
May 18, 2026SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, CVE-2026-7301 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordantiproof.aigithub.com
May 14, 2026Valtimo is an open-source business process automation platform.CVE-2026-44516 · Other software · valtimo-platform · reported by GitHubHigh 7.6
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting. This vulnerability is fixed in 12.33.0 and 13.26.0.
- Product
- valtimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Valtimo is an open-source business process automation platform.CVE-2026-42555 · Other software · valtimo-platform · reported by GitHubCritical 9.1
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.
- Product
- valtimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2026WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject maliciouCVE-2022-50947 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject JavaScript payloads through the testimonial title field that execute in the browsers of users viewing the draft post, enabling cookie theft and session hijacking.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 23, 2026Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents.CVE-2025-62373 · Other software · pipecat-ai · reported by GitHubCritical 9.8
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializer class (now deprecated) intended for LiveKit integration. The class's `deserialize()` method uses Python's `pickle.loads()` on data received from WebSocket clients without any validation or sanitization. This means that a malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server. The vulnerable code resides in `src/pipecat/serializers/livekit.py` (around line 73), where untrusted WebSocket message data is passed directly into `pickle.loads()` for deserialization. If a Pipecat server is configured to use LivekitFrameSerializer and is listening on an external interface (e.g. 0.0.0.0), an attacker on the network (or the internet, if the service is exposed) could achieve remote code execution (RCE) on the server by sending a malicious pickle payload. Version 0.0.94 contains a fix. Users of Pipecat should avoid or replace unsafe deserialization and improve network security configuration. The be
- Product
- pipecat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026Valtimo is an open-source business process automation platform.CVE-2026-34164 · Other software · valtimo-platform · reported by GitHubMedium 4.9
Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.
- Product
- valtimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code witCVE-2026-6348 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.3
WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges on the local machine as well as on all hosts within the environment where the agent is installed.
- Product
- WinMatrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 10, 2026Optimole – Optimize Images in Real Time: Reflected Cross-Site ScriptingCVE-2026-5226 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Optimole – Optimize Images in Real Time
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update Optimole – Optimize Images in Real Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2026Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Stored Cross-Site ScriptingCVE-2026-5217 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's' parameter (srcset descriptor) in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. The endpoint validates requests using an HMAC signature and timestamp, but these values are exposed directly in the frontend HTML making them accessible to any visitor. The plugin uses sanitize_text_field() on the descriptor value of rest.php, which strips HTML tags but does not escape double quotes. The poisoned descriptor is then stored via transients (backed by the WordPress options table) and later retrieved and injected verbatim into the srcset attribute of tag_replacer.php without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
- Product
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2026Marimo Remote Code Execution VulnerabilityCVE-2026-39987 · Other software · Marimo · reported by GitHubExploitedCritical 9.3
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
- Product
- Marimo
- On CISA’s list since
- Apr 23, 2026 (federal fix deadline May 7, 2026)
- What to do
- Attackers are using this now. Install Marimo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 8, 2026Strong Testimonials: Stored Cross-Site ScriptingCVE-2026-3239 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Strong Testimonials
- Affected
- up to 3.2.21
- What to do
- Affects up to 3.2.21. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2026IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies.CVE-2026-4820 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Maximo Application Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages CVE-2026-22742 · Other software · Spring · reported by security@vmware.comHigh 8.6
Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows an attacker to induce the server to issue HTTP requests to unintended internal or external destinations. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.CVE-2026-30162 · Other software · Auntvt · reported by MITREMedium 6.1
Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.
- Product
- Timo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neutCVE-2025-14684 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
- Product
- Maximo Application Suite - Monitor Component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injectingCVE-2019-25639 · Other software · Matri4Web · reported by VulnCheckHigh 8.8
Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various POST parameters. Attackers can inject malicious SQL payloads into parameters like txtGender, religion, Fage, and cboCountry across simplesearch_results.php, advsearch_results.php, specialcase_results.php, locational_results.php, and registration2.php to extract sensitive database information or execute arbitrary SQL commands.
- Product
- Matrimony Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.commatri4web.com
Mar 24, 2026Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_liCVE-2019-25635 · Other software · Zeeways · reported by VulnCheckHigh 8.8
Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_list endpoint. Attackers can inject SQL code via the up_cast, s_mother, and s_religion parameters to extract sensitive database information using time-based or error-based techniques.
- Product
- Zeeways Matrimony CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzeeways.comexploit-db.com
Mar 20, 2026Aimogen Pro: Arbitrary Function Call that can lead to privilege escalationCVE-2026-4038 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic_call_ai_function_realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update_option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Aimogen Pro
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Aimogen Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 12, 2026SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using picCVE-2026-3059 · Other software · SGLang · reported by cret@cert.orgCritical 9.8
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026iMoney: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iMoney imoney allows Reflected XSS.This issue affects iMoney: from n/a through <= 0.36.
- Product
- iMoney
- Affected
- up to 0.36
- What to do
- Affects up to 0.36. Update iMoney to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Testimonial Slider: Missing AuthorizationCVE-2025-68000 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2026-2716 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Client Testimonial Slider
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026Strong Testimonials: Missing AuthorizationCVE-2026-24957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.
- Product
- Strong Testimonials
- Affected
- up to 3.2.20
- What to do
- Affects up to 3.2.20. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies AssociationCVE-2025-7760 · Other software · Ofisimo Web-Based Software Technologies · reported by iletisim@usom.gov.trHigh 7.6
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers. This issue affects Association Web Package Flora: from v3.0 through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Association Web Package Flora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 24, 2026Canto Testimonials: Stored Cross-Site ScriptingCVE-2026-1095 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Canto Testimonials
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Canto Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
- Product
- Apimo Connector
- Affected
- up to 2.6.5.2
- What to do
- Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2026Testimonials Creator: Stored Cross-Site ScriptingCVE-2025-14379 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Testimonials Creator
- What to do
- Update Testimonials Creator to the newest version.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 13, 2026AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes.CVE-2023-54328 · Other software · Aimone-Video-Converter · reported by VulnCheckMedium 5.1
AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes. Attackers can generate a 7000-byte payload to trigger the denial of service and potentially exploit the software's registration mechanism.
- Product
- AimOne Video Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaimone-video-converter.software.informer.comgithub.com
Jan 13, 2026Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' infoCVE-2025-65784 · Other software · Hubert · reported by MITREMedium 6.5
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request.
- Product
- HUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbCVE-2025-65783 · Other software · Hubert · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- Product
- HUB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2025-13897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aft_testimonial_meta_name' custom field in the Client Information metabox in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected administrative page.
- Product
- Client Testimonial Slider
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026Testimonial Master: Reflected Cross-Site ScriptingCVE-2025-14127 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Testimonial Master
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Testimonial Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025Strong Testimonials: Unauthorized modification of dataCVE-2025-14426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
- Product
- Strong Testimonials
- Affected
- up to 3.2.18
- What to do
- Affects up to 3.2.18. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 29, 2025UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.CVE-2025-60458 · Other software · Antimof · reported by MITREMedium 6.5
UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.
- Product
- Uxplay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025MinimogWP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60069 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.
- Product
- MinimogWP
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update MinimogWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Tourimo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58892 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tourimo tourimo allows PHP Local File Inclusion.This issue affects Tourimo: from n/a through <= 1.2.3.
- Product
- Tourimo
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Tourimo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025In the Linux kernel, the following vulnerability has been resolved: media: imon: make send_packet() more robust syzbot is reporting that imon has three probleCVE-2025-68194 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: media: imon: make send_packet() more robust syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1]. First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls). Alan Stern commented [2] that In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away. but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed. Since I'm no
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 16, 2025MinimogWP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68062 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.
- Product
- MinimogWP
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update MinimogWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Stars Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67912 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-and-masonry-grid allows Stored XSS.This issue affects Stars Testimonials: from n/a through <= 3.3.4.
- Product
- Stars Testimonials
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025Quick Testimonials: Stored Cross-Site ScriptingCVE-2025-14378 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Quick Testimonials
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Quick Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 10, 2025A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a23CVE-2025-66004 · Other software · libimobiledevice · reported by meissner@suse.deMedium 5.1
A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a23d57a8cba.
- Product
- usbmuxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comlists.debian.org
Dec 5, 2025A vulnerability was identified in Himool ERP up to 2.2.CVE-2025-14089 · Other software · Himool · reported by VulDBLow 2.1
A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary useCVE-2025-50433 · Other software · Monnit · reported by MITRECritical 9.8
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.
- Product
- Imonnit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome.CVE-2025-65108 · Other software · simonhaenisch · reported by GitHubCritical 10
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.
- Product
- md-to-pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025Creta Testimonial Showcase: Is vulnerable to Local File InclusionCVE-2025-10686 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.
- Product
- Creta Testimonial Showcase
- Fixed in
- 1.2.4
- What to do
- Update Creta Testimonial Showcase to 1.2.4 or newer.
Nov 7, 2025Datasette is an open source multi-tool for exploring and publishing data.CVE-2025-64481 · Other software · simonw · reported by GitHubLow 2.7
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
- Product
- datasette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.