Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
604 results · page 5 of 13
Mar 2, 2026Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing anaCVE-2026-3337 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.2
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
- Product
- AWS-LC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Feb 20, 2026Court Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68852 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmuehle Court Reservation court-reservation allows Reflected XSS.This issue affects Court Reservation: from n/a through <= 1.10.13.
- Product
- Court Reservation
- Affected
- up to 1.10.13
- What to do
- Affects up to 1.10.13. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2026-26963 · Other software · cilium · reported by GitHubMedium 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from Pods on other nodes when Native Routing, WireGuard and Node Encryption are enabled. This issue has been fixed in version 1.18.6.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026The issue was addressed with additional restrictions on the observability of app states.CVE-2026-20680 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. A sandboxed app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 10, 2026Observable Timing Discrepancy vulnerability in Apache Shiro.CVE-2026-23901 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 1
Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.
- Product
- Apache Shiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 3, 2026Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject maCVE-2020-37081 · Other software · Fishing Reservation System · reported by VulnCheckHigh 7.1
Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database management system and web application without user interaction.
- Product
- Fishing Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfishingreservationsystem.comexploit-db.com
Feb 2, 2026Five Star Restaurant Reservations: Does not have CSRF checks in some bulk actionsCVE-2026-0658 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.9
- What to do
- Update Five Star Restaurant Reservations to 2.7.9 or newer.
Jan 23, 2026Quick Restaurant Reservations: Missing AuthorizationCVE-2026-24529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through <= 1.6.7.
- Product
- Quick Restaurant Reservations
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Quick Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Reservation: Missing AuthorizationCVE-2025-69095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
- Product
- Reservation
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2025-61782 · Other software · OpenCTI-Platform · reported by GitHubMedium 5.4
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.CVE-2025-61781 · Other software · OpenCTI-Platform · reported by GitHubHigh 7.1
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources. An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue.
- Product
- opencti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Five Star Restaurant Reservations: Authorization Bypass Through User-Controlled KeyCVE-2025-68044 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2026REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-55374 · Other software · Vanderbilt · reported by MITREMedium 5.3
REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.
- Product
- Redcap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Five Star Restaurant Reservations: Cross-Site Request Forgery (CSRF)CVE-2025-68601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Five Star Restaurant Reservations – WordPress Booking: Stored Cross-Site ScriptingCVE-2025-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Five Star Restaurant Reservations – WordPress Booking
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Five Star Restaurant Reservations – WordPress Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2025Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64221 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.
- Product
- Reservation
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Advance Seat Reservation Management for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58951 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooCommerce scw-seat-reservation allows SQL Injection.This issue affects Advance Seat Reservation Management for WooCommerce: from n/a through <= 3.1.
- Product
- Advance Seat Reservation Management for WooCommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025In the Linux kernel, the following vulnerability has been resolved: crash: fix crashkernel resource shrink When crashkernel is configured with a high reservatCVE-2025-68198 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x18
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 15, 2025Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries.CVE-2023-53877 · Websites & servers · Phpjabbers · reported by VulnCheckCritical 9.3
Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database.
- Product
- Bus Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comphpjabbers.com
Nov 28, 2025OpenObserve is a cloud-native observability platform.CVE-2025-66223 · Other software · openobserve · reported by GitHubHigh 8.4
OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.
- Product
- openobserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Cilium is a networking, observability, and security solution with an eBPF-based dataplane.CVE-2025-64715 · Other software · cilium · reported by GitHubMedium 4
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability.CVE-2025-40545 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.8
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
- Product
- SolarWinds Observability Self-Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Nov 18, 2025SolarWinds Observability Self-Hosted XSS Vulnerability.CVE-2025-26391 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.4
SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.
- Product
- SolarWinds Observability Self-Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Nov 17, 2025Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially coCVE-2025-52457 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 5.7
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
- Product
- HBUS Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Nov 13, 2025OpenObserve is a cloud-native observability platform.CVE-2025-64744 · Other software · openobserve · reported by GitHubLow 3.5
OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
- Product
- openobserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.CVE-2025-25236 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52Medium 5.3
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.
- Product
- Omnissa Workspace ONE UEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Nov 12, 2025A flaw was found in the Observability Operator.CVE-2025-2843 · Other software · rhobs · reported by Red HatHigh 8.8
A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.
- Product
- observability-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 12, 2025Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.CVE-2025-37734 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2025Alex Reservations: Smart Restaurant Booking: Arbitrary file uploadsCVE-2025-12399 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Alex Reservations: Smart Restaurant Booking
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Alex Reservations: Smart Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 6, 2025Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running asCVE-2025-37735 · Other software · Elastic · reported by security@elastic.coHigh 7
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabilCVE-2025-11145 · Other software · CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. · reported by iletisim@usom.gov.trHigh 7.5
Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting. This issue affects enVision: before 250566.
- Product
- enVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 23, 2025Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality.CVE-2025-34155 · Other software · Tibbo Systems · reported by VulnCheckMedium 6.9
Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.
- Product
- AggreGate Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaggregate.digitalaggregate.digital
Oct 21, 2025Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.CVE-2025-59438 · Computers, phones & browsers · ARM · reported by MITREMedium 5.3
Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmbed-tls.readthedocs.iombed-tls.readthedocs.io
Oct 21, 2025SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account.CVE-2025-26392 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.4
SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.
- Product
- Observability Self-Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 16, 2025D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability.CVE-2025-34255 · Network & remote access · D-Link · reported by VulnCheckMedium 6.9
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.
- Product
- Nuclias Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comdlink.com
Oct 16, 2025D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability.CVE-2025-34254 · Network & remote access · D-Link · reported by VulnCheckMedium 6.9
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distinct JSON responses depending on whether the supplied username is associated with an existing account. Because the responses differ in the `error.message`string value, an unauthenticated remote attacker can enumerate valid usernames/accounts on the server. NOTE: D-Link states that a fix is under development.
- Product
- Nuclias Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comdlink.com
Oct 15, 2025OpenSearch Data Prepper as an open source data collector for observability data.CVE-2025-62371 · Other software · opensearch-project · reported by GitHubHigh 7.4
OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.
- Product
- data-prepper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returCVE-2025-36225 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
- Product
- Aspera Faspex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2.CVE-2025-11337 · Other software · Four-Faith · reported by VulDBMedium 5.5
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Water Conservancy Informatization Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2.CVE-2025-11336 · Other software · Four-Faith · reported by VulDBMedium 5.5
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Water Conservancy Informatization Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0.CVE-2025-11018 · Other software · Four-Faith · reported by VulDBMedium 5.5
A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Water Conservancy Informatization Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc.CVE-2025-9031 · Other software · DivvyDrive Information Technologies Inc. · reported by iletisim@usom.gov.trMedium 4.3
Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.
- Product
- DivvyDrive Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 23, 2025A flaw has been found in Reservation Online Hotel Reservation System 1.0.CVE-2025-10843 · Other software · Reservation · reported by VulDBMedium 5.5
A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
- Product
- Online Hotel Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.CVE-2025-55887 · Other software · ARD · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
- Product
- GEC EN Ligne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comservices.ard.fr
Sep 19, 2025A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0.CVE-2025-10709 · Other software · Four-Faith · reported by VulDBMedium 5.5
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Water Conservancy Informatization Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0.CVE-2025-10708 · Other software · Four-Faith · reported by VulDBMedium 5.5
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /history/historyDownload.do;usrlogout.do. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Water Conservancy Informatization Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-10630 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.
- Product
- grafana-zabbix-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Mesa Mesa Reservation Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48319 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through <= 1.0.0.
- Product
- Mesa Mesa Reservation Widget
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Mesa Mesa Reservation Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2025SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability.CVE-2025-52219 · Other software · Selectzero · reported by MITREMedium 6.5
SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML Injection.
- Product
- Selectzero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection.CVE-2025-52218 · Other software · Selectzero · reported by MITREHigh 7.5
SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allows attackers to inject arbitrary text or limited HTML into the login page.
- Product
- Selectzero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.