Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,114 results · page 8 of 23
Jan 16, 2026HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a securiCVE-2025-59870 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.4
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
- Product
- MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2026-22803 · Other software · sveltejs · reported by GitHubHigh 8.2
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte.CVE-2025-67647 · Other software · sveltejs · reported by GitHubHigh 8.4
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026BlackSheep is an asynchronous web framework to build event based web applications with Python.CVE-2026-22779 · Other software · Neoteroi · reported by GitHubMedium 6.3
BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests (e.g. insert a new header) or even create a new HTTP request. Exploitation requires developers to pass unsanitized user input directly into headers.The server part is not affected because BlackSheep delegates to an underlying ASGI server handling of response headers. This vulnerability is fixed in 2.4.6.
- Product
- BlackSheep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22818 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22817 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-22610 · Other software · angular · reported by GitHubHigh 8.5
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Werkzeug is a comprehensive WSGI web application library.CVE-2026-21860 · Other software · pallets · reported by GitHubMedium 6.3
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
- Product
- werkzeug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.CVE-2026-21876 · Other software · coreruleset · reported by GitHubCritical 9.3
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Product
- coreruleset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Frappe is a full-stack web application framework.CVE-2025-68953 · Other software · frappe · reported by GitHubHigh 7.5
Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-69200 · Other software · thorsten · reported by GitHubHigh 7.5
phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-68951 · Other software · thorsten · reported by GitHubMedium 5.4
phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Frappe is a full-stack web application framework.CVE-2025-68929 · Other software · frappe · reported by GitHubCritical 9
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page.CVE-2025-8769 · Other software · MegaSys Computer Technologies · reported by ics-cert@hq.dhs.govCritical 9.3
Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.
- Product
- Telenium Online Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-58053 · Other software · galette · reported by GitHubMedium 4.9
Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-58052 · Other software · galette · reported by GitHubLow 2.1
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-53922 · Other software · galette · reported by GitHubLow 1.3
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JaCVE-2025-13873 · Other software · ObjectPlanet · reported by 64c5ae8f-7972-4697-86a0-7ada793ac795Medium 4.8
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2025-66412 · Other software · angular · reported by GitHubHigh 8.5
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66206 · Other software · frappe · reported by GitHubMedium 6.8
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Frappe is a full-stack web application framework.CVE-2025-66205 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Werkzeug is a comprehensive WSGI web application library.CVE-2025-66221 · Other software · pallets · reported by GitHubMedium 6.3
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
- Product
- werkzeug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2025-66035 · Other software · angular · reported by GitHubHigh 7.7
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protCVE-2025-66021 · Other software · OWASP · reported by GitHubHigh 8.6
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
- Product
- java-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2025Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized.CVE-2025-41087 · Other software · Taclia · reported by cve-coordination@incibe.esMedium 5.1
Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource.
- Product
- Taclia's web application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password CVE-2025-55796 · Other software · Openml · reported by MITREHigh 7.5
The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover.
- Product
- Openml Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-62519 · Other software · thorsten · reported by GitHubHigh 7.2
phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login pCVE-2025-63747 · Other software · Testmanagement · reported by MITRECritical 9.8
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access.
- Product
- Qatraq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.CVE-2025-64308 · Other software · Brightpick AI · reported by ics-cert@hq.dhs.govHigh 7.1
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.
- Product
- Brightpick Mission Control / Internal Logic Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrightpick.aigithub.com
Nov 7, 2025A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.CVE-2025-63785 · Other software · Onlook · reported by MITREMedium 6.1
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An attacker can exploit this to inject malicious HTML and script code, which is then executed within the context of the preview iframe, allowing for the execution of arbitrary scripts in the user's session.
- Product
- Onlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.soohyun.techtossbank.notion.site
Nov 7, 2025An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.CVE-2025-63784 · Other software · Onlook · reported by MITREMedium 6.5
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.
- Product
- Onlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.soohyun.techtossbank.notion.site
Nov 4, 2025Galette is a membership management web application for non profit organizations.CVE-2025-48884 · Other software · galette · reported by GitHubMedium 5.3
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2025Galette is a membership management web application for non profit organizations.CVE-2025-48076 · Other software · galette · reported by GitHubMedium 5.3
Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025The web application is vulnerable to a so-called ‘clickjacking’ attack.CVE-2025-64387 · Other software · Circutor · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 5.1
The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login credentials in a form that, a priori, appears legitimate.
- Product
- TCPRS1plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comcircutor.com
Oct 30, 2025Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do.CVE-2021-4461 · Other software · Seeyon · reported by VulnCheckCritical 9.3
Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
- Product
- Zhiyuan OA Web Application System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Movary is a web application to track, rate and explore your movie watch history.CVE-2025-64116 · Other software · leepeuker · reported by GitHubMedium 5.1
Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validation, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Movary is a web application to track, rate and explore your movie watch history.CVE-2025-64115 · Other software · leepeuker · reported by GitHubMedium 5.1
Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2025Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2025-62610 · Other software · honojs · reported by GitHubHigh 8.1
Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Frappe is a full-stack web application framework.CVE-2025-62407 · Other software · frappe · reported by GitHubMedium 6.1
Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page, if a specific type of URL was passed in. This vulnerability is fixed in 14.98.0 and 15.83.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses wheCVE-2025-42906 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 5.3
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.
- Product
- SAP Commerce Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Sinatra is a domain-specific language for creating web applications in Ruby.CVE-2025-61921 · Other software · sinatra · reported by GitHubLow 2.7
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
- Product
- sinatra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ruby-lang.orggithub.com
Oct 9, 2025A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may iCVE-2025-10240 · Other software · Progress Software · reported by security@progress.comHigh 8.8
A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session.
- Product
- Flowmon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 3, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-59943 · Other software · thorsten · reported by GitHubHigh 8.1
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application.CVE-2025-52653 · Other software · HCL · reported by psirt@hcl.comHigh 7.6
HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
- Product
- HCL MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 30, 2025The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input.CVE-2025-10659 · Other software · MegaSys · reported by ics-cert@hq.dhs.govCritical 9.3
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.
- Product
- Telenium Online Web Application:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.portal.megasys.comcisa.gov
Sep 29, 2025The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflowCVE-2025-55795 · Other software · Openml · reported by MITRELow 3.5
The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.
- Product
- Openml Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing autCVE-2025-41716 · Other software · WAGO · reported by info@cert.vde.comMedium 5.3
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
- Product
- Solution Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially CVE-2025-41715 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
- Product
- Device Sphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application.CVE-2025-57145 · Websites & servers · Phpgurukul · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser.
- Product
- Auto Taxi Stand Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection.CVE-2024-13174 · Other software · E1 Informatics · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection. This issue affects Web Application: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
- Product
- Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.