Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,305 results · page 8 of 47
Feb 13, 2026BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services.CVE-2026-21870 · Other software · bacnet-stack · reported by GitHubMedium 5.5
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. In 1.4.2, 1.5.0.rc2, and earlier, an off-by-one stack-based buffer overflow in the ubasic interpreter causes a crash (SIGABRT) when processing string literals longer than the buffer limit. The tokenizer_string function in src/bacnet/basic/program/ubasic/tokenizer.c incorrectly handles null termination for maximum-length strings. It writes a null byte to dest[40] when the buffer size is only 40 (indices 0-39), triggering a stack overflow.
- Product
- bacnet-stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicatioCVE-2025-9293 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.7
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
- Product
- Tapo App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomadanetworks.comtp-link.com
Feb 11, 2026PJSIP is a free and open source multimedia communication library written in C.CVE-2026-25994 · Other software · pjsip · reported by GitHubHigh 8.1
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform anCVE-2024-36311 · Other software · AMD · reported by psirt@amd.comMedium 4.6
A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially resuCVE-2024-36310 · Other software · AMD · reported by psirt@amd.comMedium 4.6
Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially resulting in loss of confidentiality or integrity.
- Product
- AMD EPYC™ 9004 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 throuCVE-2025-62439 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.2
An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comcert-portal.siemens.com
Feb 10, 2026An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.CVE-2025-12063 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 5.7
An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server.CVE-2025-13064 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.5
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.CVE-2025-12757 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.6
An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.CVE-2025-11547 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.8
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
- Product
- AXIS Camera Station Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.CVE-2025-11142 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 7.1
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Address read vulnerability in the communication module.CVE-2026-24918 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 3, 2026Unicamp: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25027 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.7.1.
- Product
- Unicamp
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Unicamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry aCVE-2025-5319 · Other software · Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. DIGITA Efficiency Management System allows SQL Injection. This issue affects DIGITA Efficiency Management System: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DIGITA Efficiency Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 2, 2026The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server.CVE-2026-24933 · Network & remote access · ASUSTOR · reported by security@asustor.comHigh 8.9
The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnerability allows an unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to intercept the cleartext communication, potentially leading to the exposure of sensitive user information, including account emails, MD5 hashed passwords, and device serial numbers. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
- Product
- ADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2.CVE-2026-22224 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 8.5
A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
- Product
- Archer BE230 v1.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Jan 26, 2026Vulnerability in Altitude Authentication Service and Altitude Communication Server v8.5.3290.0 by Altitude, where manipulation of Host header in HTTP requests aCVE-2025-41083 · Other software · Altitude · reported by cve-coordination@incibe.esMedium 5.1
Vulnerability in Altitude Authentication Service and Altitude Communication Server v8.5.3290.0 by Altitude, where manipulation of Host header in HTTP requests allows redirection to an arbitrary URL or modification of the base URL to trick the victim into sending login credentials to a malicious website. This behavior can be used to redirect clients to endpoints controlled by the attacker.
- Product
- Altitude Communication Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single KeepCVE-2025-41082 · Other software · Altitude · reported by cve-coordination@incibe.esMedium 6.9
Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection using Content-Length headers. This can cause a desynchronization of requests between frontend and backend servers, which could allow request hiding, cache poisoning or security bypass.
- Product
- Altitude Communication Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications.CVE-2026-23524 · Other software · laravel · reported by GitHubCritical 9.8
Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).
- Product
- reverb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jan 21, 2026Cisco Unified Communications Products Code Injection VulnerabilityCVE-2026-20045 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.2
Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
- Product
- Unified Communications Manager
- On CISA’s list since
- Jan 21, 2026 (federal fix deadline Feb 11, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comcisa.gov
Jan 20, 2026Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in MilCVE-2025-58742 · Other software · Milner · reported by 57dba5dd-1a03-47f6-8b36-e84e47d335d8High 8.5
Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by modifying the 'Server' field to redirect client authentication.This issue affects ImageDirector Capture: from 7.0.9 before 7.6.3.25808.
- Product
- ImageDirector Capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code executCVE-2026-22844 · Other software · Zoom Communications Inc. · reported by security@zoom.usCritical 9.9
A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
- Product
- Zoom Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers toCVE-2026-1223 · Other software · BROWAN COMMUNICATIONS · reported by twcert@cert.org.twMedium 6.9
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to obtain SMTP plaintext passwords through the web frontend.
- Product
- PrismX MX100 AP controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 20, 2026PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and exeCVE-2026-1222 · Other software · BROWAN COMMUNICATIONS · reported by twcert@cert.org.twHigh 8.6
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- PrismX MX100 AP controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 20, 2026PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to lCVE-2026-1221 · Other software · BROWAN COMMUNICATIONS · reported by twcert@cert.org.twCritical 9.3
PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to the database using hardcoded database credentials stored in the firmware.
- Product
- PrismX MX100 AP controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 14, 2026Rocket.Chat is an open-source, secure, fully customizable communications platform.CVE-2026-23477 · Other software · RocketChat · reported by GitHubHigh 7.7
Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communicationCVE-2025-67813 · Other software · Quest · reported by MITREMedium 5.3
Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordquest.comsupport.quest.com
Jan 12, 2026D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel.CVE-2025-65552 · Other software · D3dsecurity · reported by MITRECritical 9.8
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attacker within RF range to record valid alarm/control frames and replay them to trigger false alarms.
- Product
- Zx-g12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comd3dsecurity.com
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22697 · Other software · nasa · reported by GitHubHigh 7.5
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib’s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22027 · Other software · nasa · reported by GitHubMedium 5.7
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the convert_hexstring_to_byte_array() function in the MariaDB SA interface writes decoded bytes into a caller-provided buffer without any capacity check. When importing SA fields from the database (e.g., IV, ARSN, ABM), a malformed or oversized hex string in the database can overflow the destination buffer, corrupting adjacent heap memory. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22026 · Other software · nasa · reported by GitHubHigh 8.2
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the libcurl write_callback function in the KMC crypto service client allows unbounded memory growth by reallocating response buffers without any size limit or overflow check. A malicious KMC server can return arbitrarily large HTTP responses, forcing the client to allocate excessive memory until the process is terminated by the OS. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22025 · Other software · nasa · reported by GitHubMedium 6.3
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, when the KMC server returns a non-200 HTTP status code, cryptography_encrypt() and cryptography_decrypt() return immediately without freeing previously allocated buffers. Each failed request leaks approximately 467 bytes. Repeated failures (from a malicious server or network issues) can gradually exhaust memory. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22024 · Other software · nasa · reported by GitHubMedium 6.3
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each call leaks approximately 400 bytes of memory. Sustained traffic can gradually exhaust available memory. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-22023 · Other software · nasa · reported by GitHubHigh 8.2
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, there is an out-of-bounds heap read vulnerability in cryptography_aead_encrypt(). This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-21900 · Other software · nasa · reported by GitHubHigh 8.2
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, an out-of-bounds heap read vulnerability in cryptography_encrypt() occurs when parsing JSON metadata from KMC server responses. The flawed strtok iteration pattern uses ptr + strlen(ptr) + 1 which reads one byte past allocated buffer boundaries when processing short or malformed metadata strings. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-21899 · Other software · nasa · reported by GitHubMedium 4.7
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, in base64urlDecode, padding-stripping dereferences input[inputLen - 1] before checking that inputLen > 0 or that input != NULL. For inputLen == 0, this becomes an OOB read at input[-1], potentially crashing the process. If input == NULL and inputLen == 0, it dereferences NULL - 1. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-21898 · Other software · nasa · reported by GitHubHigh 8.2
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_AOS_ProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCVE-2026-21897 · Other software · nasa · reported by GitHubHigh 7.3
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the parameter lookup/registration logic that relies on it. This issue has been patched in version 1.4.3.
- Product
- CryptoLib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication.CVE-2026-0719 · Other software · Red Hat · reported by Red HatHigh 8.6
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 7, 2026An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protoCVE-2026-22535 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6High 8.9
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology InCVE-2025-2406 · Other software · Verisay Communication and Information Technology Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.6
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS). This issue affects Trizbi: before 2.144.4.
- Product
- Trizbi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 25, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology InCVE-2025-2405 · Other software · Verisay Communication and Information Technology Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.6
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Titarus allows Cross-Site Scripting (XSS). This issue affects Titarus: before 2.144.4.
- Product
- Titarus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 25, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology InCVE-2025-2307 · Other software · Verisay Communication and Information Technology Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.6
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS). This issue affects Aidango: before 2.144.4.
- Product
- Aidango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 23, 2025eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.CVE-2025-67108 · Other software · Eprosima · reported by MITRECritical 10
eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
- Product
- Fast DDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 22, 2025Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-boundCVE-2023-53970 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckHigh 8.7
Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 22, 2025Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addressCVE-2023-53969 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckCritical 9.3
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 22, 2025Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addressCVE-2023-53968 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckCritical 9.3
Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 22, 2025Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the curCVE-2023-53967 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckCritical 9.3
Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sending a crafted POST request with a new MD5-hashed password to directly modify the admin account's authentication.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 18, 2025Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other.CVE-2025-53710 · Other software · Palantir · reported by cve-coordination@palantir.comHigh 7.5
Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This issue resulted in bypass of access control due to the presence of a vulnerable endpoint in Foundry Container Service that executed user-controlled commands locally.
- Product
- com.palantir.compute:compute-service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Information disclosure while exposing internal TA-to-TA communication APIs to HLOSCVE-2025-47319 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.