Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
860 results · page 5 of 18
Mar 31, 2026OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the eCVE-2026-32971 · Other software · OpenClaw · reported by VulnCheckHigh 7.3
OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attackers can place wrapper binaries and induce wrapper-shaped commands to execute local code after operators approve misleading command text.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 29, 2026A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow CVE-2025-15036 · Other software · mlflow · reported by security@huntr.devCritical 10
A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2026Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command executiCVE-2026-4946 · Other software · NSA · reported by cve@takeonme.orgHigh 8.8
Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.
- Product
- Ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtakeonme.org
Mar 29, 2026A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-CVE-2026-0558 · Other software · parisneo · reported by security@huntr.devCritical 9.8
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.
- Product
- parisneo/lollms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artCVE-2025-15617 · Other software · Wazuh · reported by VulnCheckHigh 8.3
Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.
- Product
- Wazuh (GitHub Actions)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 26, 2026qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by pCVE-2018-25208 · Other software · Qdpm · reported by VulnCheckHigh 8.8
qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.
- Product
- qdPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory tCVE-2025-70952 · Other software · Pf4j Project · reported by MITREHigh 7.5
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
- Product
- Pf4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 25, 2026Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642.CVE-2025-67030 · Other software · Red Hat · reported by MITREHigh 8.8
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
- Product
- Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 25, 2026textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.CVE-2026-26831 · Other software · Dbashford · reported by MITRECritical 9.8
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
- Product
- Textract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() ouCVE-2026-23346 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN: | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_remote_vm+0x18/0x30 | environ_read+0x238/0x3e8 | vfs_read+0xe4/0x2b0 | ksys_read+0xcc/0x178 | __arm64_sys_read+0x4c/0x68 Extract only the memory type from the user 'pgprot_t' in ioremap_prot() and assert that we're being passed a user mapping, to protect us against any changes in future that may require additional handling. To avoid falsely flagging users
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33176 · Other software · rails · reported by GitHubMedium 6.6
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33170 · Other software · rails · reported by GitHubMedium 5.3
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.CVE-2026-33169 · Other software · rails · reported by GitHubMedium 6.9
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Product
- activesupport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archCVE-2026-32044 · Other software · OpenClaw · reported by VulnCheckMedium 6.7
OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attackers can craft malicious tar.bz2 skill archives to bypass special-entry blocking and extracted-size guardrails, causing local denial of service during skill installation.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.CVE-2026-31381 · Other software · Gainsight · reported by cve@rapid7.comMedium 5.3
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
- Product
- Gainsight Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapid7.comcommunities.gainsight.com
Mar 19, 2026Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config.CVE-2026-3849 · Other software · wolfSSL Inc. · reported by facts@wolfssl.comMedium 6.9
Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server supporting ECH. Note that ECH is off by default, and is only enabled with enable-ech.
- Product
- wolfSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended desCVE-2026-27670 · Other software · OpenClaw · reported by VulnCheckMedium 5.8
OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race between path validation and file write operations by rebinding parent directory symlinks to redirect writes outside the extraction root.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries.CVE-2025-15031 · Other software · mlflow · reported by security@huntr.devCritical 9.1
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.comaccess.redhat.com
Mar 18, 2026Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted arCVE-2026-33001 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioaccess.redhat.com
Mar 16, 2026Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game filesCVE-2025-66687 · Other software · reported by MITREHigh 7.5
Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjeroscope.com
Mar 16, 2026Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities that allow unauthenticated attackers to extract databaseCVE-2015-20120 · Other software · Next Click Ventures · reported by VulnCheckHigh 8.8
Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities that allow unauthenticated attackers to extract database information by injecting SQL code into application parameters. Attackers can craft requests with time-delay payloads to infer database contents character by character based on response timing differences.
- Product
- RealtyScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 12, 2026A vulnerability allowing a low-privileged user to extract saved SSH credentials.CVE-2026-21670 · Other software · Veeam · reported by support@hackerone.comHigh 7.7
A vulnerability allowing a low-privileged user to extract saved SSH credentials.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 throCVE-2026-2741 · Other software · vaadin · reported by security@vaadin.comLow 2.3
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
- Product
- vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.CVE-2026-23907 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Product
- Apache PDFBox Examples
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 10, 2026An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.CVE-2025-41711 · Other software · Janitza · reported by info@cert.vde.comMedium 5.3
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
- Product
- UMG 96RM-E 24V(5222063)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Mar 6, 2026Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the gCVE-2018-25173 · Other software · Sms · reported by VulnCheckHigh 8.8
Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the gid parameter. Attackers can send GET requests to editgrp.php with malicious gid values using EXTRACTVALUE and CONCAT functions to retrieve schema names and sensitive database data.
- Product
- Rmedia SMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 5, 2026OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitraryCVE-2026-28486 · Other software · OpenClaw · reported by VulnCheckMedium 6.8
OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory. Attackers can craft malicious archives that, when extracted via skills install, hooks install, plugins install, or signal install commands, write files to arbitrary locations enabling persistence or code execution.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the inCVE-2026-28453 · Other software · OpenClaw · reported by VulnCheckHigh 8.3
OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to write files outside extraction boundaries, potentially enabling configuration tampering and code execution.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers CVE-2026-28452 · Other software · OpenClaw · reported by VulnCheckMedium 6.7
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x.CVE-2025-66945 · Other software · Zdir · reported by MITRECritical 9.1
A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution
- Product
- Zdir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzeroday.endlessparadox.com
Mar 2, 2026An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools.CVE-2026-0754 · Other software · HP Inc · reported by hp-security-alert@hp.comHigh 8.2
An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.
- Product
- VVX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4.CVE-2026-27800 · Other software · zed-industries · reported by GitHubHigh 7.4
Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The `extract_zip()` function in `crates/util/src/archive.rs` fails to validate ZIP entry filenames for path traversal sequences (e.g., `../`). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.
- Product
- zed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineeriCVE-2025-1242 · Other software · Gardyn · reported by ics-cert@hq.dhs.govCritical 9.3
The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicious control.
- Product
- Home Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Feb 24, 2026bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files.CVE-2026-27117 · Other software · rikyoz · reported by GitHubMedium 5.5
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability ("Zip Slip") exists in bit7z's archive extraction functionality. The library does not adequately validate file paths contained in archive entries, allowing files to be written outside the intended extraction directory through three distinct mechanisms: relative path traversal, absolute path traversal, and symbolic link traversal. An attacker can exploit this by providing a malicious archive to any application that uses bit7z to extract untrusted archives. Successful exploitation results in arbitrary file write with the privileges of the process performing the extraction. This could lead to overwriting of application binaries, configuration files, or other sensitive data. The vulnerability does not directly enable reading of file contents; the confidentiality impact is limited to the calling application's own behavior after extraction. However, applications that subsequently serve or display extracted files may face secondary confidentiality risks from attacker-created symlinks. Fixes have been released in version 4.0.11. If up
- Product
- bit7z
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026A vulnerability was detected in CCExtractor up to 0.96.5.CVE-2026-2889 · Other software · reported by VulDBLow 1.9
A vulnerability was detected in CCExtractor up to 0.96.5. Affected is the function processmp4 in the library src/lib_ccx/mp4.c. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 0.96.6 is able to address this issue. The patch is named fd7271bae238ccb3ae8a71304ea64f0886324925. You should upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction dirCVE-2026-2818 · Other software · VMware · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cHigh 8.2
A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.
- Product
- Spring Data Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherodevs.comaccess.redhat.com
Feb 19, 2026Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location.CVE-2026-2817 · Other software · VMware · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.8
Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.
- Product
- Spring Data Geode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id froCVE-2026-23180 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 9, 2026A vulnerability was identified in CCExtractor up to 183.CVE-2026-2245 · Other software · reported by VulDBLow 1.9
A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library src/lib_ccx/ts_tables.c of the component MPEG-TS File Parser. Such manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The name of the patch is fd7271bae238ccb3ae8a71304ea64f0886324925. It is best practice to apply a patch to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Magic Import Document Extractor: Sensitive Information ExposureCVE-2025-15508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.
- Product
- Magic Import Document Extractor
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2026Magic Import Document Extractor: Unauthorized modification of dataCVE-2025-15507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
- Product
- Magic Import Document Extractor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal.CVE-2025-63372 · Other software · Articentgroup · reported by MITREMedium 4.3
Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifically in the functionality responsible for extracting and handling ZIP archive contents.
- Product
- ZIP RAR Extractor Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Vulnerability in Wikimedia Foundation TextExtracts.CVE-2025-61653 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.7
Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.
- Product
- TextExtracts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
Feb 2, 2026When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory.CVE-2026-1703 · Other software · Python Packaging Authority · reported by cna@python.orgLow 2
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- Product
- pip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026EAP Legislator is vulnerable to Path Traversal in file extraction functionality.CVE-2026-1186 · Other software · ABC PRO SP. Z O.O. · reported by cvd@cert.plHigh 8.6
EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (default file type used by the Legislator application) and choose arbitrary path outside the intended directory (e.x. system startup) where files will be extracted by the victim upon opening the file. This issue was fixed in version 2.25a.
- Product
- EAP Legislator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes.CVE-2020-37051 · Other software · sunnygkp10 · reported by VulnCheckHigh 8.8
Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploit the 'feed.php' endpoint by crafting malicious payload requests that use time delays to systematically enumerate user password characters.
- Product
- Online-Exam-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 29, 2026The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes fCVE-2020-37004 · Other software · codexcube · reported by VulnCheckHigh 7.1
The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting malicious search parameters to progressively guess and retrieve user credentials through boolean-based inference techniques.
- Product
- Ultimate Project Manager CRM PRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordultimatepro.codexcube.comexploit-db.com
Jan 28, 2026`bulk_extractor` is a digital forensics exploitation tool.CVE-2026-24857 · Other software · simsong · reported by GitHubMedium 5.5
`bulk_extractor` is a digital forensics exploitation tool. Starting in version 1.4, `bulk_extractor`’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out‑of‑bounds write in `Unpack::CopyString`, leading to a crash under ASAN (and likely a crash or memory corruption in production builds). There's potential for using this for RCE. As of time of publication, no known patches are available.
- Product
- bulk_extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database infoCVE-2020-36972 · Other software · smartdatasoft · reported by VulnCheckHigh 8.8
SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information. Attackers can systematically test and retrieve database contents by injecting crafted SQL queries that compare character-by-character of database information.
- Product
- SmartBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 27, 2026vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.CVE-2026-24909 · Other software · vlt · reported by MITREMedium 5.9
vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.
- Product
- vlt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.