Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
816 results · page 4 of 17
Feb 9, 2026In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsCVE-2026-25846 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs CVE-2026-1337 · Other software · neo4j · reported by 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6Low 1.1
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Product
- Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the striCVE-2025-71179 · Other software · Creativeitem · reported by MITREMedium 6.1
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netcreativeitem.com
Feb 2, 2026Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs.CVE-2025-12772 · Other software · Brocade · reported by sirt@brocade.comHigh 8.5
Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the call stack trace for the Brocade switch is also collected in the heap dump file which contains this switch password in clear text. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the switch admin password.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover.CVE-2025-12680 · Other software · Brocade · reported by sirt@brocade.comMedium 6
Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the database password.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product CVE-2025-55704 · Other software · Brother Industries, Ltd. · reported by vultures@jpcert.or.jpMedium 6.9
Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs.
- Product
- Multiple MFPs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfaq.brother.co.jpjvn.jp
Jan 16, 2026In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations.CVE-2026-0519 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 4.6
In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer hCVE-2026-22644 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.
- Product
- Incoming Goods Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026WPBlogSyn: Cross-Site Request ForgeryCVE-2025-14389 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's remote sync settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WPBlogSyn
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WPBlogSyn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2026Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys.CVE-2026-22041 · Computers, phones & browsers · armurox · reported by GitHubLow 2
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are converted into string types, leading to type errors in %d conversions. The problem has been patched in version 0.0.6. No known workarounds are available.
- Product
- loggingredactor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via CVE-2025-66834 · Other software · Trueconf · reported by MITREHigh 7.3
A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name.
- Product
- Trueconf Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrueconf.com
Dec 17, 2025Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker wiCVE-2025-13321 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.3
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025Divelogs Widget: Stored Cross-Site ScriptingCVE-2025-13962 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Divelogs Widget
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Divelogs Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2025A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other ApigCVE-2025-13292 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.6
A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.
- Product
- Apigee-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comfocalsecurity.io
Dec 2, 2025SureMail – SMTP and Email Logs: Unrestricted Upload of File with Dangerous TypeCVE-2025-13516 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.
- Product
- SureMail – SMTP and Email Logs
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update SureMail – SMTP and Email Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcwe.mitre.orgplugins.trac.wordpress.org
Nov 27, 2025SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.CVE-2025-13757 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows).CVE-2025-64695 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpHigh 8.4
Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privilege of the user invoking the installer.
- Product
- Installer of LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025LogStare Collector improperly handles the password hash data.CVE-2025-64299 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpMedium 6.9
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.
- Product
- LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Cross-site request forgery vulnerability exists in LogStare Collector.CVE-2025-62687 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpMedium 6.9
Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed.
- Product
- LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025LogStare Collector contains an incorrect authorization vulnerability in UserRegistration.CVE-2025-62189 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpMedium 5.3
LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account by sending a crafted HTTP request.
- Product
- LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement.CVE-2025-61949 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpMedium 4.8
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page.
- Product
- LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025The installation directory of LogStare Collector is configured with incorrect access permissions.CVE-2025-58097 · Other software · LogStare Inc. · reported by vultures@jpcert.or.jpMedium 6.8
The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory and execute arbitrary code with the administrative privilege.
- Product
- LogStare Collector (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out.CVE-2025-56643 · Other software · Requarks · reported by MITRECritical 9.1
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
- Product
- Wiki.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitraryCVE-2025-63918 · Other software · Cnblogs · reported by MITREMedium 6.2
PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowing attackers to upload arbitrary files to arbitrary locations.
- Product
- Pdfpatcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references.CVE-2025-63917 · Other software · Cnblogs · reported by MITREHigh 7.1
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary files from the victim's filesystem, exfiltrate sensitive data via out-of-band (OOB) HTTP requests, perform SSRF attacks against internal network resources, or cause a denial of service via entity expansion attacks.
- Product
- Pdfpatcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight ManaCVE-2025-12940 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 0.5
Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6 Access Points). An user having access to the syslog server can read the logs containing these credentials. This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4. Devices managed with Insight get automatic updates. If not, please check the firmware version and update to the latest. Fixed in: WAX610 firmware 11.8.0.10 or later. WAX610Y firmware 11.8.0.10 or later.
- Product
- WAX610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.netgear.comnetgear.com
Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
- Product
- Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4CVE-2025-62275 · Other software · Liferay · reported by security@liferay.comMedium 6.9
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is CVE-2025-62232 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.
- Product
- Apache APISIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 30, 2025Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the roCVE-2025-34274 · Other software · Nagios · reported by VulnCheckCritical 9.3
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk associated with a network-facing service that can accept untrusted input or load third-party components.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table.CVE-2016-15049 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.CVE-2025-62265 · Other software · Liferay · reported by security@liferay.comMedium 4.8
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.CVE-2025-36081 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Video Blogster Lite: Cross-Site Request Forgery (CSRF)CVE-2025-60132 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
- Product
- Video Blogster Lite
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2025The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304.CVE-2025-10639 · Other software · EfficientLab · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
- Product
- WorkExaminer Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Oct 9, 2025A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting arbCVE-2025-56683 · Other software · reported by MITRECritical 9.6
A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting arbitrary Javascript into a crafted README.md file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/apCVE-2025-44824 · Other software · Nagios · reported by MITREHigh 8.5
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_useCVE-2025-44823 · Other software · Nagios · reported by MITRECritical 9.9
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnagios.com
Oct 7, 2025CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulCVE-2025-57564 · Other software · reported by MITREHigh 8.2
CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform unauthorized log injection. Exploitation may lead to false log entries, log poisoning, alert obfuscation, and potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform and is not limited to specific deployment configurations.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-CVE-2025-56675 · Other software · EKEN · reported by MITRELow 3.5
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.
- Product
- video doorbell T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com
Sep 22, 2025Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata.CVE-2025-59433 · Other software · conventional-changelog · reported by GitHubMedium 5.3
Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags() API, which allows extra parameters to be passed to the git log command. In another API by this library, getRawCommits(), there are secure practices taken to ensure that the extra parameter path is unable to inject an argument by ending the git log command with the special shell syntax --. However, the library does not follow the same practice for getTags() as it does not attempt to sanitize for user input, validate the given params, or restrict them to an allow list. Nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options. Thus, allowing users to exploit an argument injection vulnerability in Git due to the --output= command-line option that results with overwriting arbitrary files. This issue has been patched in version 2.0.0.
- Product
- conventional-changelog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the erroCVE-2023-53375 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace: [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_tr
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 12, 2025A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs.CVE-2025-4234 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 2.4
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
- Product
- Cortex XDR Microsoft 365 Defender Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Sep 8, 2025When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs.CVE-2025-42933 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP Business One (SLD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.CVE-2025-7445 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.5
Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.
- Product
- secrets-store-sync-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2025The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data CVE-2025-30041 · Other software · CGM · reported by cvd@cert.plCritical 9
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter vaCVE-2025-50974 · Other software · Ipfire · reported by MITREMedium 6.5
The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following parameters BYTE_UNIT, DAY_BEGIN, DAY_END, HIST_LEVEL, MONTH_BEGIN, MONTH_END, NUM_CONTENT, NUM_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END.
- Product
- Ipfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs.CVE-2025-3456 · Other software · Arista Networks · reported by psirt@arista.comLow 3.8
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB.CVE-2025-6791 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 8.8
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.