Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,833 results · page 6 of 57
Mar 9, 2026A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4.CVE-2026-3816 · Other software · OWASP · reported by VulDBLow 2.1
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.
- Product
- DefectDojo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informationCVE-2025-14480 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.1
IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
- Product
- Aspera faspio Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118.CVE-2026-3263 · Other software · go2ismail · reported by VulDBMedium 5.3
A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functionality of the file /api/Security/ of the component Security API. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Asp.Net-Core-Inventory-Order-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118.CVE-2026-3262 · Other software · go2ismail · reported by VulDBLow 2.1
A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected is an unknown function of the component Administrative Interface. Such manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Asp.Net-Core-Inventory-Order-Management-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScCVE-2026-1694 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary iCVE-2026-2878 · Other software · Progress Software · reported by security@progress.comMedium 5.3
In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.
- Product
- Telerik UI for ASP.NET AJAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code CVE-2019-25366 · Other software · Microasp · reported by VulnCheckHigh 8.8
microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.
- Product
- microASP (Portal+) CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicroasp.itexploit-db.com
Feb 20, 2026Saasplate Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69309 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.
- Product
- Saasplate Core
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Saasplate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute cCVE-2026-2731 · Other software · DynamicWeb · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166Critical 10
Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests
- Product
- DynamicWeb 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2026Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program FilesCVE-2026-26335 · Other software · Calero · reported by VulnCheckCritical 9.3
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.
- Product
- VeraSMART
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcalero.comvulncheck.com
Feb 13, 2026A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crCVE-2025-69770 · Other software · reported by MITRECritical 10
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent (CVE-2023-31323 · Other software · AMD · reported by psirt@amd.comHigh 8.4
Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent (XGMI TA) leading to a memory safety violation potentially resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect TrusCVE-2023-31324 · Other software · AMD · reported by psirt@amd.comHigh 7.1
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA) commands as they are processed potentially resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, CVE-2023-20548 · Other software · AMD · reported by psirt@amd.comHigh 7.1
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusteCVE-2023-20514 · Other software · AMD · reported by psirt@amd.comHigh 8.7
Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environment resulting in arbitrary code execution
- Product
- AMD Radeon™ RX 6000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potCVE-2025-48515 · Other software · AMD · reported by psirt@amd.comMedium 5.4
Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.
- Product
- AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and arCVE-2025-29951 · Other software · AMD · reported by psirt@amd.comHigh 7.3
A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and arbitrary code execution.
- Product
- AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds tCVE-2025-29949 · Other software · AMD · reported by psirt@amd.comMedium 4.8
Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds to corrupt Secure DRAM potentially resulting in denial of service.
- Product
- AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing anCVE-2021-26410 · Other software · AMD · reported by psirt@amd.comLow 1.8
Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential information disclosure.
- Product
- AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and securiCVE-2020-37150 · Other software · EDIMAX Technology · reported by VulnCheckHigh 8.7
Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without authentication.
- Product
- EW-7438RPn-v3 Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 5, 2026IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection.CVE-2025-13379 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.6
IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file.CVE-2020-37097 · Other software · EDIMAX Technology Co., Ltd. · reported by VulnCheckHigh 8.7
Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device configuration variables.
- Product
- EW-7438RPn Mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedimax.comexploit-db.com
Feb 2, 2026RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability.CVE-2026-24788 · Other software · RaspAP · reported by vultures@jpcert.or.jpHigh 8.7
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.
- Product
- raspap-webgui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.CVE-2025-13925 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.
- Product
- Aspera Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GCVE-2025-71121 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used e.g. in HP 730 workstations. When trying to reprogram the affinity it will crash with a HPMC as the relevant registers don't seem to be at the usual location. Let's avoid the crash by checking the sversion. Also note, that reprogramming isn't necessary either, as the HP730 is a just a single-CPU machine.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 8, 2026OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber'CVE-2026-22235 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
- Product
- eComplaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Jan 8, 2026OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable valuesCVE-2026-22234 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
- Product
- eCase Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Jan 8, 2026Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu BusinesCVE-2025-61550 · Other software · Edubusinesssolutions · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization. This allows attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDeskCVE-2025-61549 · Other software · Edubusinesssolutions · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print ShopCVE-2025-61548 · Other software · Edubusinesssolutions · reported by MITRECritical 9.8
SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) thCVE-2025-61546 · Other software · Edubusinesssolutions · reported by MITRECritical 9.1
There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) that enables remote attacker to create financial discrepancies by purchasing items with a negative quantity. This vulnerability is possible due to reliance on client-side input validation controls.
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.CVE-2026-21876 · Other software · coreruleset · reported by GitHubCritical 9.3
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Product
- coreruleset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication cCVE-2020-36914 · Other software · Shenzhen Xingmeng Qihang Media Co., Ltd. · reported by VulnCheckHigh 8.6
QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through cleartext cookie transmission. Attackers can perform man-in-the-middle attacks to capture and potentially misuse stored authentication credentials transmitted in an insecure manner.
- Product
- QiHang Media Web (QH.aspx) Digital Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Dec 30, 2025In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a poinCVE-2023-54319 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle (kmerr.cocci script). Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int")
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 30, 2025In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would return NULL pointer CVE-2022-50866 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would return NULL pointer when kmalloc() fail to allocate. Need to check the return pointer before calling strcmp().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 26, 2025IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection.CVE-2025-36230 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- Product
- Aspera Faspex 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.CVE-2025-36229 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
- Product
- Aspera Faspex 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that aCVE-2025-36228 · Other software · IBM · reported by psirt@us.ibm.comLow 3.8
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.
- Product
- Aspera Faspex 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service.CVE-2023-53949 · Other software · Aspemail · reported by VulnCheckHigh 8.5
AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Attackers can exploit full write permissions in the BIN directory to replace the service executable and gain elevated system access.
- Product
- AspEmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaspemail.comexploit-db.com
Dec 16, 2025In the Linux kernel, the following vulnerability has been resolved: crypto: aspeed - fix double free caused by devm The clock obtained via devm_clk_get_enableCVE-2025-68172 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: crypto: aspeed - fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 12, 2025The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.CVE-2025-8083 · Other software · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cHigh 8.6
The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data. If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process. This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10. Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodepen.ioherodevs.com
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to impropCVE-2025-13481 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection.CVE-2025-13214 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interCVE-2025-13211 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that passwCVE-2025-13148 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
- Product
- Aspera Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete fiCVE-2020-36898 · Other software · Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd. · reported by VulnCheckHigh 8.8
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
- Product
- QiHang Media Web Digital Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhowfor.comexploit-db.com
Dec 10, 2025QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicCVE-2020-36897 · Other software · Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. · reported by VulnCheckCritical 9.3
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
- Product
- QiHang Media Web Digital Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhowfor.comexploit-db.com
Dec 9, 2025Umbraco is an ASP.NET CMS.CVE-2025-66625 · Other software · umbraco · reported by GitHubMedium 4.9
Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. This issue is fixed in version 13.12.1.
- Product
- Umbraco-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx.CVE-2025-34407 · Other software · MailEnable · reported by VulnCheckMedium 5.3
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of an existing iframe context and inject arbitrary script. A remote attacker can supply a crafted payload that closes the iframe tag, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
- Product
- MailEnable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailenable.commailenable.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.