Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
380 results · page 3 of 8
Sep 22, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through <= 3.2.3.
- Product
- Verowa Connect
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2025On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthCVE-2025-57176 · Other software · Ceragon Networks / Siklu Communication · reported by MITREMedium 6.5
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.
- Product
- EtherHaul and MultiHaul Series microwave antennas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.CVE-2025-59397 · Other software · openwebanalytics · reported by MITREMedium 5
Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.
- Product
- Open Web Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy.CVE-2024-49722 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Sep 1, 2025Knowage is an open source analytics and business intelligence suite.CVE-2025-55007 · Other software · KnowageLabs · reported by GitHubLow 3.5
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker could be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
- Product
- Knowage-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-54571 · Other software · owasp-modsecurity · reported by GitHubMedium 6.9
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Focus incorrectly truncated URLs towards the beginning instead of around the origin.CVE-2025-8043 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jul 19, 2025An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer CVE-2025-29757 · Other software · Growatt · reported by csirt@divd.nlCritical 9.4
An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.
- Product
- https://oss.growatt.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jul 16, 2025If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other tCVE-2025-40777 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.isc.orgopenwall.com
Jul 2, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-52891 · Other software · owasp-modsecurity · reported by GitHubMedium 6.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Społecznościowa 6 PL 2013: Cross-Site Request Forgery (CSRF)CVE-2025-53329 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 spolecznosciowa-6-pl-2013 allows Stored XSS.This issue affects Społecznościowa 6 PL 2013: from n/a through <= 2.0.6.
- Product
- Społecznościowa 6 PL 2013
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Społecznościowa 6 PL 2013 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-48866 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1.CVE-2025-5247 · Other software · Gowabby · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The manipulation of the argument r leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- HFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-47947 · Other software · owasp-modsecurity · reported by GitHubHigh 7.5
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd ACVE-2025-4430 · Other software · Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy · reported by cvd@cert.plHigh 8.6
Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd August 2024).
- Product
- EZD RP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_disCVE-2025-40325 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_discard should wait barrier before returning a discard bio which has REQ_NOWAIT. And there is no need to print warning calltrace if a discard bio has REQ_NOWAIT flag. Quality engineer usually checks dmesg and reports error if dmesg has warning/error calltrace.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 17, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Reflected XSS.This issue affects Verowa Connect: from n/a through <= 3.0.4.
- Product
- Verowa Connect
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-31950 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain other users' charger information.CVE-2025-31945 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain other users' charger information.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-31654 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-31360 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31147 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-30512 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An attacker can upload an arbitrary file instead of a plant image.CVE-2025-30510 · Other software · Growatt · reported by ics-cert@hq.dhs.govCritical 9.3
An attacker can upload an arbitrary file instead of a plant image.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.CVE-2025-30257 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27929 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-27927 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27719 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query an API endpoint and get device details.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-27575 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-27565 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-27561 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename "rooms" of arbitrary users.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).CVE-2025-26857 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-25276 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can hijack other users' devices and potentially control them.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An attacker can export other users' plant information.CVE-2025-24850 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can export other users' plant information.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).CVE-2025-24315 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.CVE-2025-24297 · Other software · Growatt · reported by ics-cert@hq.dhs.govCritical 9.3
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An authenticated attacker can obtain any plant name by knowing the plant ID.CVE-2025-31949 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An authenticated attacker can obtain any plant name by knowing the plant ID.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.CVE-2025-31941 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can check the existence of usernames in the system by querying an API.CVE-2025-31933 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a user's plant list by knowing the username.CVE-2025-31357 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a user's plant list by knowing the username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-30514 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.CVE-2025-30511 · Other software · Growatt · reported by ics-cert@hq.dhs.govHigh 8.7
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-30254 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An attacker can change registered email addresses of other users and take over arbitrary accounts.CVE-2025-27939 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can change registered email addresses of other users and take over arbitrary accounts.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-27938 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can get users' emails by knowing usernames.CVE-2025-27568 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An unauthenticated attacker can infer the existence of usernames in the system by querying an API.CVE-2025-24487 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025Verowa Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32676 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through <= 3.0.5.
- Product
- Verowa Connect
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.CVE-2025-29914 · Other software · corazawaf · reported by GitHubMedium 5.4
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.
- Product
- coraza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctl_tcp_notsent_lowat.CVE-2022-49587 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.7
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix a data-race around sysctl_tcp_notsent_lowat. While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.