Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

7,488 results · page 57 of 150

Sep 27, 2023The issue was addressed with improved checks.CVE-2023-41074 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023An authorization issue was addressed with improved state management.CVE-2023-41073 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access protected user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A use-after-free issue was addressed with improved memory management.CVE-2023-41071 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Ventura 13.6. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A logic issue was addressed with improved checks.CVE-2023-41070 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive data logged when a user shares a link.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023An access issue was addressed with improved access restrictions.CVE-2023-41068 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7. A user may be able to elevate privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A privacy issue was addressed with improved private data redaction for log entries.CVE-2023-41065 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to read sensitive location information.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-41063 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-40520 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to access edited photos saved to a temporary directory.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-40456 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to access edited photos saved to a temporary directory.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40454 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to delete files for which it does not have permission.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved bounds checks.CVE-2023-40452 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to overwrite arbitrary files.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved handling of protocols.CVE-2023-40448 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
The issue was addressed with improved handling of protocols. This issue is fixed in tvOS 17, iOS 16.7 and iPadOS 16.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. A remote attacker may be able to break out of Web Content sandbox.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-40443 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to gain root privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org support.apple.com
Sep 27, 2023A resource exhaustion issue was addressed with improved input validation.CVE-2023-40441 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to a denial-of-service.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A configuration issue was addressed with additional restrictions.CVE-2023-40434 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access a user's Photos Library.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40432 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40431 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org support.apple.com
Sep 27, 2023A permissions issue was addressed with improved validation.CVE-2023-40429 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved handling of caches.CVE-2023-40428 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in iOS 17 and iPadOS 17. An app may be able to access sensitive user data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org support.apple.com
Sep 27, 2023The issue was addressed with improved handling of caches.CVE-2023-40427 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read sensitive location information.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-40424 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access user-sensitive data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40420 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to a denial-of-service.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-40419 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to gain elevated privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A window management issue was addressed with improved state management.CVE-2023-40417 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.4
A window management issue was addressed with improved state management. This issue is fixed in Safari 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Visiting a website that frames malicious content may lead to UI spoofing.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40412 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023An out-of-bounds read was addressed with improved input validation.CVE-2023-40410 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to disclose kernel memory.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40409 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40403 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023This issue was addressed with improved checks.CVE-2023-40400 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. A remote user may cause an unexpected app termination or arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40399 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to disclose kernel memory.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved handling of caches.CVE-2023-40395 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access contacts.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-40391 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to disclose kernel memory.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A permissions issue was addressed with improved redaction of sensitive information.CVE-2023-40384 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read sensitive location information.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023A use-after-free issue was addressed with improved memory management.CVE-2023-39434 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved handling of protocols.CVE-2023-38596 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved handling of protocols. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may fail to enforce App Transport Security.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-35990 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be able to identify what other apps a user has installed.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved checks.CVE-2023-35984 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proximity can cause a limited out of bounds write.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved memory handling.CVE-2023-35074 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023This issue was addressed with improved checks.CVE-2023-32396 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
This issue was addressed with improved checks. This issue is fixed in Xcode 15, tvOS 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to gain elevated privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 27, 2023The issue was addressed with improved handling of caches.CVE-2023-32361 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access user-sensitive data.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Sep 21, 2023D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.CVE-2023-43241 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.
Product
dir-823g
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com dlink.com
Sep 19, 2023A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration CVE-2023-40934 · Other software · Nagios · reported by MITREHigh 7.2
A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com nagios.com
Sep 19, 2023A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitraCVE-2023-40933 · Other software · Nagios · reported by MITREHigh 8.8
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com nagios.com
Sep 19, 2023A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to injeCVE-2023-40932 · Other software · Nagios · reported by MITREMedium 5.4
A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com nagios.com
Sep 19, 2023A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via tCVE-2023-40931 · Other software · Nagios · reported by MITREMedium 6.5
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com nagios.com
Sep 19, 2023A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside CVE-2023-41387 · Other software · patreon · reported by MITRECritical 9.1
A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if an app uses UIFileSharingEnabled and LSSupportsOpeningDocumentsInPlace properties. As a result, local users can obtain the same attack primitives as remote attackers by tampering with the internal database of the framework on the device.
Product
flutter_downloader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pub.dev seredynski.com
Sep 15, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.CVE-2023-32461 · Other software · Dell · reported by security_alert@emc.comMedium 5
Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.
Product
PowerEdge Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36659 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
Product
Metadefender Kiosk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.opswat.com docs.opswat.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36657 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
Product
Metadefender Kiosk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.opswat.com docs.opswat.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36658 · Other software · Opswat · reported by MITREHigh 7.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
Product
Media Validation Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.opswat.com docs.opswat.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.