Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

1,565 results · page 5 of 32

May 16, 2026WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating CVE-2021-47979 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 16, 2026Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating thCVE-2020-37246 · Other software · Supsystic · reported by VulnCheckMedium 6.9
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.
Product
Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record downloads.wordpress.org supsystic.com
May 14, 2026Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g.CVE-2026-6475 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Product
Postgresql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record postgresql.org
May 14, 2026Database Backup for: Authorization bypassCVE-2026-4031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized arbitrary file read and deletionCVE-2026-4030 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized database exportCVE-2026-4029 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files.CVE-2026-25107 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.9
ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.
Product
WRC-X1800GS-B
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp elecom.co.jp
May 12, 2026Sandbox escape in the Profile Backup component.CVE-2026-8401 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
May 11, 2026Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.CVE-2026-45362 · Other software · Sangoma · reported by MITRELow 3.2
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
Product
Switchvox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 8, 2026The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66172 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Product
Apache CloudStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 8, 2026The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66171 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Product
Apache CloudStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 8, 2026The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66170 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
Product
Apache CloudStack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 8, 2026Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commandsCVE-2025-69690 · Other software · Pfsense · reported by MITRECritical 9.1
Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.
Product
Pfsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org linkedin.com
May 5, 2026WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database bacCVE-2023-54346 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record backupbliss.com downloads.wordpress.org
May 4, 2026A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1.CVE-2026-29200 · Other software · WebPros · reported by support@hackerone.comCritical 9.9
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.
Product
Comet Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.cometbackup.com
May 1, 2026Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Unauthorized modification of dataCVE-2026-3143 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2026Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute CVE-2018-25261 · Other software · Iperiusbackup · reported by VulnCheckHigh 8.6
Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local attackers to execute arbitrary code by supplying a malicious file path. Attackers can create a backup job with a crafted payload in the external file location field that triggers a buffer overflow when the backup job executes, enabling code execution with application privileges.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com iperiusbackup.com
Apr 17, 2026A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.CVE-2026-21709 · Other software · Veeam · reported by support@hackerone.comMedium 6.7
A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com veeam.com
Apr 17, 2026JetBackup – Backup, Restore & Migrate: Path Traversal leading to Arbitrary Directory DeletionCVE-2026-4853 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.
Product
JetBackup – Backup, Restore & Migrate
Affected
up to 3.1.19.8
What to do
Affects up to 3.1.19.8. Update JetBackup – Backup, Restore & Migrate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 12, 2026Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file containing sensitive infoCVE-2019-25706 · Other software · Across · reported by VulnCheckHigh 8.7
Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file containing sensitive information by sending a simple GET request. Attackers can access the rom-0 endpoint without authentication to retrieve and decompress the backup file, exposing router passwords and other sensitive configuration data.
Product
DR-810
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ac.i8i.ir exploit-db.com
Apr 9, 2026Royal WordPress Backup & Restore: Reflected Cross-Site ScriptingCVE-2026-4305 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpr_pending_template' parameter in all versions up to, and including, 1.0.16 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
Royal WordPress Backup & Restore
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Royal WordPress Backup & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2026In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instancCVE-2026-34178 · Other software · Canonical · reported by security@ubuntu.comCritical 9.1
In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.
Product
lxd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 7, 2026Backup Migration: Missing AuthorizationCVE-2025-14944 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
Product
Backup Migration
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2026A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2.CVE-2026-5310 · Other software · Enter Software · reported by VulDBLow 1.1
A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 1, 2026A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or ConfiCVE-2026-20042 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Product
Cisco Nexus Dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Mar 25, 2026A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3.CVE-2026-4824 · Other software · Enter Software · reported by VulDBMedium 6.4
A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 25, 2026A flaw has been found in Enter Software Iperius Backup up to 8.7.3.CVE-2026-4823 · Other software · Enter Software · reported by VulDBLow 1.1
A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 8.7.4 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 25, 2026A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3.CVE-2026-4822 · Other software · Enter Software · reported by VulDBMedium 6.4
A vulnerability was detected in Enter Software Iperius Backup up to 8.7.3. Affected is an unknown function of the file C:\ProgramData\IperiusBackup\Jobs\ of the component Backup Service. Performing a manipulation results in creation of temporary file with insecure permissions. The attack is only possible with local access. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit is now public and may be used. Upgrading to version 8.7.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 25, 2026In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.CVE-2025-32991 · Other software · N2w · reported by MITRECritical 9
In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
Product
Backup& Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record n2ws.com n2ws.com
Mar 24, 2026In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrivCVE-2026-1995 · Other software · IDrive · reported by cret@cert.orgHigh 7.8
In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.
Product
IDrive Cloud Backup Client for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Mar 22, 2026Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary programs with elevated privileges by creCVE-2019-25608 · Other software · Iperius · reported by VulnCheckHigh 8.6
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary programs with elevated privileges by creating backup jobs. Attackers can configure backup jobs to execute malicious batch files or programs before or after backup operations, which run with the privileges of the Iperius Backup Service account (Local System or Administrator), enabling privilege escalation and arbitrary code execution.
Product
Iperius Backup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com iperiusbackup.com
Mar 22, 2026Backup Key Recovery 2.2.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long strinCVE-2019-25599 · Other software · Nsauditor · reported by VulnCheckMedium 6.9
Backup Key Recovery 2.2.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a buffer of 300 or more characters into the Name field during registration to trigger a crash when submitting the form.
Product
Backup Key Recovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nsauditor.com exploit-db.com
Mar 20, 2026Keep Backup Daily: Stored Cross-Site ScriptingCVE-2026-3577 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_alias` AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While `sanitize_text_field()` strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without `esc_attr()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.
Product
Keep Backup Daily
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Keep Backup Daily: Limited Path TraversalCVE-2026-3339 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
Product
Keep Backup Daily
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG39CVE-2025-67112 · Other software · reported by MITRECritical 9.8
Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to decrypt, modify, and re-encrypt device configurations, enabling credential manipulation and privilege escalation via the GUI import/export functions.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fcc.report freedomfi.com
Mar 18, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-3090 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.
Product
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2026A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.CVE-2026-21708 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com veeam.com
Mar 12, 2026A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.CVE-2026-21672 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com veeam.com
Mar 12, 2026A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments oCVE-2026-21671 · Other software · Veeam · reported by support@hackerone.comCritical 9.1
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
Product
Software Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 12, 2026A vulnerability allowing a low-privileged user to extract saved SSH credentials.CVE-2026-21670 · Other software · Veeam · reported by support@hackerone.comHigh 7.7
A vulnerability allowing a low-privileged user to extract saved SSH credentials.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21669 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 12, 2026A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.CVE-2026-21668 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21667 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 12, 2026A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.CVE-2026-21666 · Other software · Veeam · reported by support@hackerone.comCritical 9.9
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Mar 11, 2026Modular DS: Monitor, update, and backup multiple websites: Cross-Site Request ForgeryCVE-2026-3903 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Modular DS: Monitor, update, and backup multiple websites
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Modular DS: Monitor, update, and backup multiple websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2026An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, includiCVE-2025-41762 · Other software · MBS · reported by info@cert.vde.comMedium 6.2
An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.
Product
UBR-01 Mk II
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mbs-solutions.de
Mar 9, 2026A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the cCVE-2025-41757 · Other software · MBS · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system.
Product
UBR-01 Mk II
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mbs-solutions.de
Mar 4, 2026A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-baCVE-2025-62879 · Other software · SUSE · reported by meissner@suse.deMedium 6.8
A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.
Product
Rancher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com github.com
Mar 4, 2026Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption.CVE-2025-59785 · Other software · 2N Telekomunikace a.s. · reported by be69f613-e5f6-419b-800c-30351aa8933cMedium 5.3
Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption. This vulnerability can only be exploited after authenticating with administrator privileges.
Product
2N Access Commander
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 2n.com
Feb 26, 2026Worry Proof Backup: Path TraversalCVE-2026-1311 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a malicious ZIP archive with path traversal sequences to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution.
Product
Worry Proof Backup
Affected
up to 0.2.4
What to do
Affects up to 0.2.4. Update Worry Proof Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.