Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
764 results · page 5 of 16
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27125 · Other software · sveltejs · reported by GitHubMedium 5.3
svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27122 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27121 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026svelte performance oriented web framework.CVE-2026-27119 · Other software · sveltejs · reported by GitHubMedium 5.1
svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. This vulnerability is fixed in 5.51.5.
- Product
- svelte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-27118 · Other software · sveltejs · reported by GitHubMedium 5.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input in the Enter Key fiCVE-2019-25326 · Other software · Northwest Performance Software, Inc. · reported by VulnCheckMedium 4.6
ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input in the Enter Key field. Attackers can generate a 256-byte buffer of repeated 'A' characters to trigger an application crash when pasting the malicious content.
- Product
- ipPulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnetscantools.com
Feb 12, 2026LavinMQ is a high-performance message queue & streaming server.CVE-2026-25768 · Other software · cloudamqp · reported by GitHubHigh 7.1
LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.
- Product
- lavinmq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026LavinMQ is a high-performance message queue & streaming server.CVE-2026-25767 · Other software · cloudamqp · reported by GitHubHigh 8.6
LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
- Product
- lavinmq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.CVE-2026-24851 · Other software · openfga · reported by GitHubMedium 5.8
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Tanium addressed an incorrect default permissions vulnerability in Performance.CVE-2025-15336 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an incorrect default permissions vulnerability in Performance.
- Product
- Performance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resCVE-2025-2134 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resource pooling.
- Product
- Jazz Reporting Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Qwik is a performance focused javascript framework.CVE-2026-25155 · Other software · QwikDev · reported by GitHubMedium 5.9
Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Qwik is a performance focused javascript framework.CVE-2026-25151 · Other software · QwikDev · reported by GitHubMedium 5.9
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Qwik is a performance focused javascript framework.CVE-2026-25150 · Other software · QwikDev · reported by GitHubCritical 9.3
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Qwik is a performance focused javascript framework.CVE-2026-25149 · Other software · QwikDev · reported by GitHubLow 2.7
Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Qwik is a performance focused javascript framework.CVE-2026-25148 · Other software · QwikDev · reported by GitHubMedium 5.3
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026immich is a high performance self-hosted photo and video management solution.CVE-2026-23896 · Other software · immich-app · reported by GitHubHigh 7.2
immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1483 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in '/evaluacion_objetivos_ver_auto.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1482 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_evaluacion' in '/evaluacion_objetivos_evalua_definido.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1481 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in '/evaluacion_objetivos_anyo_sig_ver_auto.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1480 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in '/evaluacion_objetivos_anyo_sig_evalua.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1479 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameters 'Id_usuario' and 'Id_evaluacion’ in ‘/evaluacion_hca_ver_auto.asp', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1478 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion’ in ‘/evaluacion_hca_evalua.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1477 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion’ in ‘/evaluacion_competencias_evalua_old.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1476 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' in ‘/evaluacion_acciones_ver_auto.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1475 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter ‘Id_usuario' in ‘/evaluacion_acciones_evalua.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1474 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion' en ‘/evaluacion_inicio.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1473 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario’ in '/evaluacion_competencias_evalua.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de ProgramCVE-2026-1472 · Other software · Quatuor · reported by cve-coordination@incibe.esCritical 9.3
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'txAny' in '/evaluacion_competencias_autoeval_list.aspx', could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
- Product
- Evaluación de Desempeño (EDD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffeCVE-2021-47894 · Other software · Northwest Performance Software, Inc. · reported by VulnCheckMedium 6.7
Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer. Attackers can generate a 10,000-character buffer and paste it into the IP Address and SNMP Community Name fields to trigger the application crash.
- Product
- Managed Switch Port Mapping Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordswitchportmapper.comswitchportmapper.com
Jan 22, 2026Penci Shortcodes & Performance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Shortcodes & Performance penci-shortcodes allows DOM-Based XSS.This issue affects Penci Shortcodes & Performance: from n/a through <= 6.1.
- Product
- Penci Shortcodes & Performance
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Penci Shortcodes & Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2026H3 is a minimal H(TTP) framework built for high performance and portability.CVE-2026-23527 · Other software · h3js · reported by GitHubHigh 8.9
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
- Product
- h3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-22803 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2025-67647 · Other software · sveltejs · reported by GitHubHigh 8.4
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform anCVE-2025-13154 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
- Product
- Vantage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance.CVE-2025-62001 · Other software · BullWall · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.
- Product
- Ransomware Containment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Dec 18, 2025Hummingbird Performance: Sensitive Information ExposureCVE-2025-14437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
- Product
- Hummingbird Performance
- Affected
- up to 3.18.0
- What to do
- Affects up to 3.18.0. Update Hummingbird Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-66220 · Other software · envoyproxy · reported by GitHubMedium 5
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-64763 · Other software · envoyproxy · reported by GitHubLow 3.7
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Envoy is a high-performance edge/middle/service proxy.CVE-2025-64527 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Cacti is an open source performance and fault management framework.CVE-2025-66399 · Other software · Cacti · reported by GitHubHigh 7.4
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.
- Product
- cacti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025TNC Toolbox: Web Performance: Missing AuthorizationCVE-2025-66108 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4.
- Product
- TNC Toolbox: Web Performance
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2025OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.CVE-2025-64751 · Other software · openfga · reported by GitHubMedium 5.8
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.1465 within Ring 3: User Applications may aCVE-2025-24491 · Other software · reported by secure@intel.comMedium 5.4
Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.1465 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025TNC Toolbox: Web Performance: Sensitive Information ExposureCVE-2025-12539 · WordPress plugins & themes · reported by WordfenceCritical 10
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
- Product
- TNC Toolbox: Web Performance
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 31, 2025If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.CVE-2025-6075 · Other software · Python Software Foundation · reported by cna@python.orgLow 1.8
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to craCVE-2025-33133 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due an out of bounds write.
- Product
- DB2 High Performance Unload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to craCVE-2025-33132 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to.
- Product
- DB2 High Performance Unload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to craCVE-2025-33131 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
- Product
- DB2 High Performance Unload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, CVE-2025-33126 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size.
- Product
- DB2 High Performance Unload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.