Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

1,679 results · page 4 of 34

Feb 10, 2026Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privilegesCVE-2026-21522 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
Product
Microsoft ACI Confidential Containers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Feb 10, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc.CVE-2025-7636 · Other software · Ergosis Security Systems Computer Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 8.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc. ZEUS PDKS allows SQL Injection. This issue affects ZEUS PDKS: from <1.0.5.10 through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
ZEUS PDKS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Feb 10, 2026Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc.CVE-2025-11242 · Other software · Teknolist Computer Systems Software Publishing Industry and Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery. This issue affects Okulistik: through 21102025.
Product
Okulistik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Feb 5, 2026Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device.CVE-2026-0715 · Other software · Moxa · reported by psirt@moxa.comHigh 7
Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.
Product
UC-1200A Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com
Feb 5, 2026A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the disCVE-2026-0714 · Other software · Moxa · reported by psirt@moxa.comHigh 7
A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical access, including opening the device and attaching external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of eMMC contents. This attack cannot be performed through brief or opportunistic physical access and requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible.
Product
UC-1200A Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com
Feb 3, 2026LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary codCVE-2020-37075 · Other software · LizardSystems · reported by VulnCheckHigh 8.4
LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) overwrite and execute shellcode when importing computers from a file.
Product
LanSend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lizardsystems.com exploit-db.com
Feb 3, 2026Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file impCVE-2020-37074 · Other software · LizardSystems · reported by VulnCheckHigh 8.4
Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file import process. Attackers can craft a malicious payload file to trigger a structured exception handler (SEH) bypass and execute shellcode when importing computer lists.
Product
Remote Desktop Audit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lizardsystems.com exploit-db.com
Jan 30, 2026Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute arbitrary code by oCVE-2020-37042 · Other software · WinFrigate · reported by VulnCheckHigh 8.4
Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute arbitrary code by overflowing the computer name input field. Attackers can craft a malicious payload that triggers a buffer overflow, enabling code execution and launching calculator as a proof of concept.
Product
Frigate 3 Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Jan 30, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry aCVE-2025-4686 · Other software · Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam and Assessment: through 30012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Online Exam and Assessment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 29, 2026Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd.CVE-2025-7016 · Other software · Akın Software Computer Import Export Industry and Trade Ltd. · reported by iletisim@usom.gov.trHigh 8
Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.
Product
QR Menu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 29, 2026Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd.CVE-2025-7015 · Other software · Akın Software Computer Import Export Industry and Trade Ltd. · reported by iletisim@usom.gov.trMedium 5.7
Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.
Product
QR Menu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 28, 2026Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated prCVE-2020-36987 · Other software · Gearboxcomputers · reported by VulnCheckHigh 8.5
Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.
Product
Program Access Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com gearboxcomputers.com
Jan 28, 2026IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code.CVE-2020-36985 · Other software · Gearboxcomputers · reported by VulnCheckHigh 8.5
IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges during service startup.
Product
IP Watcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com gearboxcomputers.com
Jan 22, 2026Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd.CVE-2025-10024 · Other software · EXERT Computer Technologies Software Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.
Product
Education Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 22, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc.CVE-2025-4764 · Other software · Aida Computer Information Technology Inc. · reported by iletisim@usom.gov.trHigh 8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection. This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Hotel Guest Hotspot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 22, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Computer Information Technology Inc.CVE-2025-4763 · Other software · Aida Computer Information Technology Inc. · reported by iletisim@usom.gov.trMedium 5.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS. This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Hotel Guest Hotspot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23526 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.
Product
cvat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 21, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-23516 · Other software · cvat-ai · reported by GitHubHigh 8.6
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
Product
cvat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 21, 2026A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH serCVE-2026-20080 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop responding. This vulnerability exists because the SSH service lacks effective flood protection. An attacker could exploit this vulnerability by initiating a denial of service (DoS) attack against the SSH port. A successful exploit could allow the attacker to cause the SSH service to be unresponsive during the period of the DoS attack. All other operations remain stable during the attack.
Product
Cisco Ultra-Reliable Wireless Backhaul
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Jan 16, 2026WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local attackers to execute code with elevated privCVE-2021-47833 · Other software · Gearboxcomputers · reported by VulnCheckHigh 8.5
WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.
Product
WifiHotSpot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record wifi-hotspot.gearboxcomputers.com exploit-db.com
Jan 8, 2026The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://dCVE-2025-14505 · Other software · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 5.6
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This happens, because the byte-length of 'k' is incorrectly computed, resulting in its getting truncated during the computation. Legitimate transactions or communications will be broken as a result. Furthermore, due to the nature of the fault, attackers could–under certain conditions–derive the secret key, if they could get their hands on both a faulty signature generated by a vulnerable version of Elliptic and a correct signature for the same inputs. This issue affects all known versions of Elliptic (at the time of writing, versions less than or equal to 6.6.1).
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com herodevs.com
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload anCVE-2025-15240 · Other software · Quanta Computer · reported by twcert@cert.org.twHigh 8.7
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SCVE-2025-15239 · Other software · Quanta Computer · reported by twcert@cert.org.twHigh 7.1
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SCVE-2025-15238 · Other software · Quanta Computer · reported by twcert@cert.org.twHigh 7.1
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder namesCVE-2025-15237 · Other software · Quanta Computer · reported by twcert@cert.org.twMedium 5.3
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder namesCVE-2025-15236 · Other software · Quanta Computer · reported by twcert@cert.org.twMedium 5.3
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jan 5, 2026QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify speCVE-2025-15235 · Other software · Quanta Computer · reported by twcert@cert.org.twHigh 7.1
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet parameters, enabling certain system functions to access other users' files.
Product
QOCA aim AI Medical Cloud Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 24, 2025Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page.CVE-2025-8769 · Other software · MegaSys Computer Technologies · reported by ics-cert@hq.dhs.govCritical 9.3
Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.
Product
Telenium Online Web Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com megasys.com
Dec 19, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-68430 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.
Product
cvat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2025Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other.CVE-2025-53710 · Other software · Palantir · reported by cve-coordination@palantir.comHigh 7.5
Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable endpoint in Foundry Container Service that executed user-controlled commands locally.
Product
com.palantir.compute:compute-service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record palantir.safebase.us
Dec 17, 2025Open OnDemand provides remote web access to supercomputers.CVE-2025-66029 · Other software · OSC · reported by GitHubHigh 7.6
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.
Product
ondemand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Dec 12, 2025A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2025-43522 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 12, 2025A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2025-43521 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 12, 2025Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios.CVE-2023-29144 · Other software · Malwarebytes · reported by MITRELow 3.3
Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios. This allows a bypass of detection.
Product
Malwarebytes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record malwarebytes.com malwarebytes.com
Dec 12, 2025Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc.CVE-2025-13506 · Other software · Nebim Neyir Computer Industry and Services Inc. · reported by iletisim@usom.gov.trHigh 8.8
Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1.
Product
Nebim V3 ERP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 11, 2025Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc.CVE-2025-13003 · Other software · Aksis Computer Services and Consulting Inc. · reported by iletisim@usom.gov.trHigh 7.6
Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0.
Product
AxOnboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Nov 19, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd.CVE-2025-11963 · Other software · Saysis Computer Systems Trade Ltd. Co. · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61.
Product
StarCities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Nov 19, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry TradCVE-2025-10437 · Other software · Eksagate Electronic Engineering and Computer Industry Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.
Product
Webpack Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Nov 7, 2025CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2025-64485 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0.
Product
cvat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 3, 2025A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2025-43468 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Nov 3, 2025A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2025-43390 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 24, 2025Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabilCVE-2025-11145 · Other software · CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 7.5
Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting. This issue affects enVision: before 250566.
Product
enVision
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Oct 23, 2025Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.CVE-2025-59503 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
Product
Azure Compute Resource Provider
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 16, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.CVE-2024-42192 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.
Product
Traveler for Microsoft Outlook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 14, 2025External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.CVE-2025-59292 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
Product
Azure Compute Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 14, 2025External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.CVE-2025-59291 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
Product
Azure Compute Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2025Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co.CVE-2025-9902 · Other software · AKIN Software Computer Import Export Industry and Trade Co. Ltd. · reported by iletisim@usom.gov.trHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.
Product
QRMenu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Oct 9, 2025NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nCVE-2017-20203 · Other software · NetSarang Computer, Inc. · reported by VulnCheckCritical 9.3
NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT record for a month‑generated domain. After receiving a decryption key, it then downloads and executes arbitrary code, creates an encrypted virtual file system (VFS) in the registry, and grants the attacker full remote code execution, data exfiltration, and persistence. NetSarang released builds for each product line that remediated the compromise: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Kaspersky Lab identified an instance of exploitation in the wild in August 2017.
Product
Xmanager Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securelist.com usa.kaspersky.com
Oct 1, 2025Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameCVE-2025-56588 · Other software · Dolibarr · reported by MITREHigh 8.8
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 25, 2025Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled.CVE-2025-59408 · Other software · Flocksafety · reported by MITREHigh 7.3
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modified firmware with no cryptographic protections.
Product
Bravo Compute BOX Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gainsec.com gainsec.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.