Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

1,565 results · page 4 of 32

Jul 10, 2026WPvivid Backup for MainWP: Stored Cross-Site ScriptingCVE-2026-15283 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WPvivid Backup for MainWP
Affected
up to 0.9.33
What to do
Affects up to 0.9.33. Update WPvivid Backup for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2026Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service thaCVE-2026-60095 · Other software · Vinchin · reported by VulnCheckMedium 6.9
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.
Product
Backup & Recovery 9.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code-white.com vinchin.com
Jul 9, 2026Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash CVE-2026-60094 · Other software · Vinchin · reported by VulnCheckMedium 6.9
Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.
Product
Backup & Recovery 9.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code-white.com vinchin.com
Jul 9, 2026Backup and Staging by WP Time Capsule: Sensitive Information ExposureCVE-2026-8996 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.26
What to do
Affects up to 1.22.26. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature.CVE-2026-13722 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.6
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.
Product
Fireware OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.watchguard.com watchguard.com
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.CVE-2026-57757 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026WP Database Backup – Unlimited Database & Files Backup by Backup for WP: OS Command InjectionCVE-2026-9834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$()` intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option('wp_db_exclude_ta
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.11
What to do
Affects up to 7.11. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 29, 2026PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_CVE-2026-57919 · Other software · reported by MITREHigh 7.8
PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigger execution of arbitrary commands with SYSTEM privileges via an untrusted search path. This allows privilege escalation by placing a malicious shadow.exe in a controlled working directory.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.matrix42.com docs.matrix42.com
Jun 26, 2026Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes CVE-2026-9639 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Product
LXD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.CVE-2026-54839 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 24, 2026Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability.CVE-2026-9787 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULogDaemon JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27625.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability.CVE-2026-9786 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27626.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability.CVE-2026-9785 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27630.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability.CVE-2026-9784 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27631.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability.CVE-2026-9783 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableMedia JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27632.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability.CVE-2026-9782 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27633.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability.CVE-2026-9781 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27648.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability.CVE-2026-9780 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addclient3 webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27666.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability.CVE-2026-7570 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27809.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability.CVE-2026-7569 · Other software · Quest · reported by zdi-disclosures@trendmicro.comHigh 8.8
Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the viewclient webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28202.
Product
NetVault Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com zerodayinitiative.com
Jun 24, 2026In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure Apply the same fix as b2eCVE-2026-52949 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") to the ttm_bo_shrink() path. Move del_bulk_move from before the backup to after success only, using ttm_resource_del_bulk_move_unevictable() since the resource is now unevictable once fully backed up.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 21, 2026A vulnerability was determined in AOMEI Backupper up to 8.3.0.CVE-2026-12780 · Other software · AOMEI · reported by VulDBHigh 7.1
A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Product
Backupper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Jun 19, 2026Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalCVE-2016-20086 · Other software · Vembu · reported by VulnCheckHigh 8.5
Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and restart the service to execute code with LocalSystem privileges.
Product
Vembu StoreGrid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup filesCVE-2018-25437 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record cherryframework.com exploit-db.com
Jun 15, 2026WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by CVE-2016-20076 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Jun 11, 2026UpdraftPlus: WP Backup & Migration: Authentication BypassCVE-2026-10795 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Product
UpdraftPlus: WP Backup & Migration
Affected
up to 1.26.4
What to do
Affects up to 1.26.4. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jun 9, 2026A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.CVE-2026-44963 · Other software · Veeam · reported by support@hackerone.comCritical 9.4
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Jun 6, 2026LearnPress – Backup & Migration Tool: PHP Object InjectionCVE-2026-7566 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – Backup & Migration Tool: Arbitrary File ReadCVE-2026-7565 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary directory deletionCVE-2025-12656 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Product
Migration, Backup, Staging – WPvivid Backup & Migration
Affected
up to 0.9.128
What to do
Affects up to 0.9.128. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.CVE-2026-36500 · Other software · reported by MITRECritical 9.1
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.opendaylight.org github.com
Jun 3, 2026Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode.CVE-2026-36606 · Other software · reported by MITREHigh 7.1
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jun 3, 2026An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1CVE-2024-47273 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
Product
Hyper Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com
Jun 3, 2026An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup bCVE-2024-47263 · Network & remote access · Synology · reported by security@synology.comMedium 4.1
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
Product
Hyper Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com
Jun 3, 2026An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows locaCVE-2022-49042 · Network & remote access · Synology · reported by security@synology.comHigh 7.8
An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
Product
Synology Hyper Backup Explorer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com
Jun 3, 2026An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media CreatorCVE-2022-49036 · Network & remote access · Synology · reported by security@synology.comHigh 7.8
An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.
Product
Synology Active Backup for Business Recovery Media Creator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com
Jun 1, 2026SOPlanning is vulnerable to Path Traversal in backup endpoints.CVE-2026-40547 · Other software · SOPlanning · reported by cvd@cert.plMedium 6.4
SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.
Product
SOPlanning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl soplanning.org
Jun 1, 2026SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.CVE-2026-40544 · Other software · SOPlanning · reported by cvd@cert.plMedium 5.1
SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.
Product
SOPlanning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl soplanning.org
Jun 1, 2026SOPlanning does not enforce authorization for backup functionalities.CVE-2026-40543 · Other software · SOPlanning · reported by cvd@cert.plHigh 8.8
SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.
Product
SOPlanning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl soplanning.org
May 29, 2026An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.CVE-2026-42951 · Other software · Danelec · reported by ics-cert@hq.dhs.govMedium 5.9
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.
Product
MacGregor Voyage Data Recorder (VDR) G4e
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
May 29, 2026Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when thCVE-2026-9508 · Other software · Suprema · reported by cve-coordination@incibe.esCritical 10
Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.
Product
BioStar 2 (server)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
May 29, 2026The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key.CVE-2026-49201 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Critical 10
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
Product
Wave 7 router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.acer.com
May 28, 2026Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code onCVE-2026-32999 · Other software · WebPros · reported by support@hackerone.comCritical 9
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
Product
Comet Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.cometbackup.com
May 28, 2026A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.CVE-2026-32997 · Other software · Veeam · reported by support@hackerone.comHigh 8.6
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
May 28, 2026This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-32996 · Other software · Veeam · reported by support@hackerone.comHigh 7.3
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
May 27, 2026IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain aCVE-2024-56462 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain access to the underlying operating system.
Product
QRadar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
May 27, 2026Backup and Staging by WP Time Capsule: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42760 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.25
What to do
Affects up to 1.22.25. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricCVE-2025-66592 · Network & remote access · Synology · reported by security@synology.comMedium 6.1
An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
Product
Synology Active Backup for Business Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com
May 27, 2026A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.CVE-2025-30028 · Network & remote access · Synology · reported by security@synology.comHigh 8.6
A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
Product
Active Backup for Business
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.