Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
277 results · page 4 of 6
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-29081 · Other software · frappe · reported by GitHubMedium 6.5
Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-29077 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Frappe is a full-stack web application framework.CVE-2026-28436 · Other software · frappe · reported by GitHubLow 1.3
Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-29086 · Other software · honojs · reported by GitHubMedium 5.4
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-29085 · Other software · honojs · reported by GitHubMedium 6.5
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newline (\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-29045 · Other software · honojs · reported by GitHubHigh 7.5
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-27700 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Flask is a web server gateway interface (WSGI) web application framework.CVE-2026-27205 · Other software · pallets · reported by GitHubLow 2.3
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.
- Product
- flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Frappe is a full-stack web application framework.CVE-2026-25956 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitraryCVE-2019-25266 · Other software · Wondershare · reported by VulnCheckHigh 8.5
Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific directory locations to hijack the service's execution context.
- Product
- Wondershare Application Framework Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Feb 1, 2026Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code wCVE-2020-37048 · Other software · Iskysoft · reported by VulnCheckHigh 8.5
Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that would be run with the service's high-level system permissions.
- Product
- Iskysoft Application Framework Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comiskysoft.us
Jan 27, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-24771 · Other software · honojs · reported by GitHubMedium 4.7
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-24473 · Other software · honojs · reported by GitHubMedium 6.3
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-24472 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has a patch for the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-24398 · Other software · honojs · reported by GitHubMedium 4.8
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General).CVE-2026-21924 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General). Supported versions that are affected are 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4 and 25.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Application Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Utilities Application Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Application Framework accessible data as well as unauthorized read access to a subset of Oracle Utilities Application Framework accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Utilities Application Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22818 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22817 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Frappe is a full-stack web application framework.CVE-2025-68953 · Other software · frappe · reported by GitHubHigh 7.5
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Frappe is a full-stack web application framework.CVE-2025-68929 · Other software · frappe · reported by GitHubCritical 9
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Netty is an asynchronous, event-driven network application framework.CVE-2025-67735 · Other software · netty · reported by GitHubMedium 6.5
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66206 · Other software · frappe · reported by GitHubMedium 6.8
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66205 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025The ACAP Application framework could allow privilege escalation through a symlink attack.CVE-2025-5718 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6.8
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-62610 · Other software · honojs · reported by GitHubHigh 8.1
Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Frappe is a full-stack web application framework.CVE-2025-62407 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Netty is an asynchronous, event-driven network application framework.CVE-2025-59419 · Other software · netty · reported by GitHubMedium 5.5
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return (\r) and Line Feed (\n) characters in user-supplied parameters. The vulnerability exists in io.netty.handler.codec.smtp.DefaultSmtpRequest, where parameters are directly concatenated into the SMTP command string without sanitization. When methods such as SmtpRequests.rcpt(recipient) are called with a malicious string containing CRLF sequences, attackers can inject arbitrary SMTP commands. Because the injected commands are sent from the server's trusted IP address, resulting emails will likely pass SPF and DKIM authentication checks, making them appear legitimate. This allows remote attackers who can control SMTP command parameters (such as email recipients) to forge arbitrary emails from the trusted server, potentially impersonating executives and forging high-stakes corporate communications. This issue has been patched in versions 4.1.129.Final and 4.2.8.Final. No known workarounds exist.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-59139 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` middleware could allow bypassing the configured request body size limit when conflicting HTTP headers were present. The middleware previously prioritized the `Content-Length` header even when a `Transfer-Encoding: chunked` header was also included. According to the HTTP specification, `Content-Length` must be ignored in such cases. This discrepancy could allow oversized request bodies to bypass the configured limit. Most standards-compliant runtimes and reverse proxies may reject such malformed requests with `400 Bad Request`, so the practical impact depends on the runtime and deployment environment. If body size limits are used as a safeguard against large or malicious requests, this flaw could allow attackers to send oversized request bodies. The primary risk is denial of service (DoS) due to excessive memory or CPU consumption when handling very large requests. The implementation has been updated to align with the HTTP specification, ensuring that `Transfer-Encoding` takes precedence over `Content-Length`. The issue is fixed in Hono v4.9.7,
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Frappe is a full-stack web application framework.CVE-2025-58375 · Other software · frappe · reported by GitHubHigh 8.1
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-58362 · Other software · honojs · reported by GitHubHigh 7.5
Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.CVE-2025-58057 · Other software · netty · reported by GitHubMedium 6.9
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.CVE-2025-58056 · Other software · netty · reported by GitHubLow 2.9
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55732 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Frappe is a full-stack web application framework.CVE-2025-55731 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025Netty is an asynchronous, event-driven network application framework.CVE-2025-55163 · Other software · netty · reported by GitHubHigh 8.2
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Jul 10, 2025IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in recoCVE-2025-36090 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.
- Product
- Analytics Content Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52898 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52896 · Other software · frappe · reported by GitHubHigh 8.6
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025Frappe is a full-stack web application framework.CVE-2025-52895 · Other software · frappe · reported by GitHubHigh 8.7
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Flask is a web server gateway interface (WSGI) web application framework.CVE-2025-47278 · Other software · pallets · reported by GitHubLow 1.8
Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the `itsdangerous` library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first. Sites that have opted-in to use key rotation by setting `SECRET_KEY_FALLBACKS` care likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss. Version 3.1.1 contains a patch for the issue.
- Product
- flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Frappe is a full-stack web application framework.CVE-2025-30217 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30214 · Other software · frappe · reported by GitHubHigh 8
Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30213 · Other software · frappe · reported by GitHubMedium 6.3
Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025Frappe is a full-stack web application framework.CVE-2025-30212 · Other software · frappe · reported by GitHubMedium 6.6
Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail messCVE-2025-30349 · Other software · Horde · reported by MITREHigh 7.2
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
- Product
- IMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Laravel is a web application framework.CVE-2025-27515 · Other software · laravel · reported by GitHubMedium 6.9
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicatioCVE-2025-0359 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.5
During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final.CVE-2025-25193 · Other software · netty · reported by GitHubMedium 5.5
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final.CVE-2025-24970 · Other software · netty · reported by GitHubHigh 7.5
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Laravel is a web application framework.CVE-2024-52301 · Other software · laravel · reported by GitHubHigh 8.7
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
- Product
- framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.