Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
912 results · page 4 of 19
Feb 11, 2026An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central.CVE-2025-54149 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-54148 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-54147 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-54146 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-53598 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-52870 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-52869 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-52868 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-48724 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect Qsync Central.CVE-2025-48723 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-48722 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-47209 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026An out-of-bounds write vulnerability has been reported to affect Qsync Central.CVE-2025-30276 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A use of externally-controlled format string vulnerability has been reported to affect Qsync Central.CVE-2025-30269 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-30266 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability.CVE-2026-24325 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.
- Product
- SAP BusinessObjects Enterprise (Central Management Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects CentCVE-2026-1554 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even afCVE-2025-11598 · Other software · Centralny Ośrodek Informatyki · reported by cvd@cert.plLow 1
In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized This issue was fixed in version 4.71.0
- Product
- mObywatel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plinfo.mobywatel.gov.pl
Feb 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-25228 · Other software · SignalK · reported by GitHubMedium 5
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2026-23515 · Other software · SignalK · reported by GitHubCritical 9.9
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform).CVE-2026-21980 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Life Sciences Central Coding product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Central Coding. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences Central Coding accessible data as well as unauthorized read access to a subset of Oracle Life Sciences Central Coding accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
- Product
- Oracle Life Sciences Central Coding
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).CVE-2026-21974 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Central Designer. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Life Sciences Central Designer accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Oracle Life Sciences Central Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).CVE-2026-21970 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Life Sciences Central Designer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Life Sciences Central Designer accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Oracle Life Sciences Central Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform).CVE-2026-21923 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Platform). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Central Designer. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences Central Designer accessible data as well as unauthorized read access to a subset of Oracle Life Sciences Central Designer accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
- Product
- Oracle Life Sciences Central Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida.CVE-2026-23880 · Other software · HackUCF · reported by GitHubHigh 7.3
OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.
- Product
- OnboardLite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-teCVE-2026-0503 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.
- Product
- SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installCVE-2025-69260 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jan 8, 2026A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affecteCVE-2025-69259 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.5
A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability..
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jan 8, 2026A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executablCVE-2025-69258 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.8
A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executable, leading to execution of attacker-supplied code under the context of SYSTEM on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-69203 · Other software · SignalK · reported by GitHubMedium 6.3
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicio
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-68620 · Other software · SignalK · reported by GitHubCritical 9.1
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. The second is Unauthenticated Token Polling: The access request status endpoint at `/signalk/v1/access/requests/:id` returns the full state of an acce
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-68619 · Other software · SignalK · reported by GitHubHigh 7.3
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-68273 · Other software · SignalK · reported by GitHubMedium 5.3
Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-68272 · Other software · SignalK · reported by GitHubHigh 7.5
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026Signal K Server is a server application that runs on a central hub in a boat.CVE-2025-66398 · Other software · SignalK · reported by GitHubCritical 9.6
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLCVE-2025-11222 · Other software · LINE Corporation · reported by dl_cve@linecorp.comMedium 6.1
Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted URLs, potentially facilitating phishing attacks and credential theft.
- Product
- Central Dogma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.CVE-2025-59491 · Other software · Centralsquare · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 12, 2025N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.CVE-2025-9316 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bMedium 6.9
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.CVE-2025-64281 · Other software · Centralsquare · reported by MITRECritical 9.8
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 12, 2025A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.CVE-2025-64280 · Other software · Centralsquare · reported by MITRECritical 9.8
A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 12, 2025N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosureCVE-2025-11700 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bHigh 8.4
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserializationCVE-2025-11367 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 10
The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025N-central < 2025.4 is vulnerable to authentication bypass via path traversalCVE-2025-11366 · Other software · N-able · reported by a5532a13-c4dd-4202-bef1-e0b8f2f8d12bCritical 9.4
N-central < 2025.4 is vulnerable to authentication bypass via path traversal
- Product
- N-central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025A path traversal vulnerability has been reported to affect Qsync Central.CVE-2025-57712 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.3 ( 2025/08/28 ) and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue.CVE-2025-11248 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Low 3.2
ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009.CVE-2025-12266 · Other software · Zytec Dalian Zhuoyun Technology · reported by VulDBLow 2.1
A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Central Authentication Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record101.200.76.102vuldb.com
Oct 21, 2025Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.CVE-2025-7473 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.2
Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerabiliCVE-2025-5496 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Low 3.3
ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.
- Product
- Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak ExpoCVE-2025-62669 · Other software · The Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 6.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.
- Product
- Mediawiki - CentralAuth Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Oct 16, 2025Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has CVE-2025-56700 · Other software · reported by MITREMedium 5.4
Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platform, to execute arbitrary SQL commands via the datafine parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbasedigitale.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.