Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,895 results · page 9 of 58
Feb 13, 2026Starfish Review Generation & Marketing for: Unauthorized modification of data that can lead to privilege escalationCVE-2025-15157 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and including, 3.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Starfish Review Generation & Marketing for
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2026WPZOOM Addons for Elementor – Starter Templates & Widgets: Unauthorized access of dataCVE-2026-2295 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.
- Product
- WPZOOM Addons for Elementor – Starter Templates & Widgets
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update WPZOOM Addons for Elementor – Starter Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 9, 2026Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.CVE-2026-25480 · Other software · litestar-org · reported by GitHubMedium 6.5
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.
- Product
- litestar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.litestar.devgithub.com
Feb 9, 2026Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.CVE-2026-25479 · Other software · litestar-org · reported by GitHubMedium 6.5
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
- Product
- litestar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.litestar.devgithub.com
Feb 9, 2026Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.CVE-2026-25478 · Other software · litestar-org · reported by GitHubHigh 7.4
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
- Product
- litestar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.litestar.devgithub.com
Feb 6, 2026JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges.CVE-2019-25305 · Other software · Inforprograma · reported by VulnCheckHigh 8.5
JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges. Attackers can exploit the unquoted path containing spaces to inject and execute malicious code with elevated system permissions.
- Product
- JumpStart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.cominforprograma.net
Feb 2, 2026Memory corruption while calculating offset from partition start point.CVE-2025-47364 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.8
Memory corruption while calculating offset from partition start point.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge CVE-2026-1751 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.1
A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Feb 2, 2026Five Star Restaurant Reservations: Does not have CSRF checks in some bulk actionsCVE-2026-0658 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.9
- What to do
- Update Five Star Restaurant Reservations to 2.7.9 or newer.
Jan 30, 2026Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'FiCVE-2020-37031 · Other software · Ashkon Software · reported by VulnCheckHigh 8.6
Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'File' input parameter. Attackers can craft a malicious payload with 268 bytes to trigger code execution, bypassing DEP and overwriting memory addresses to launch calc.exe.
- Product
- Simple Startup Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashkon.comexploit-db.com
Jan 29, 2026BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup.CVE-2020-37016 · Other software · Barcode-Ocr · reported by VulnCheckHigh 8.5
BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will run with LocalSystem privileges.
- Product
- BarcodeOCR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbarcode-ocr.comexploit-db.com
Jan 28, 2026Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability.CVE-2025-26386 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version 6.9.7 and prior. Successful exploitation of this vulnerability could result in failure within the operating system of the machine hosting the ICU tool.
- Product
- iSTAR Configuration Utility (ICU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jan 27, 2026Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during service startup.CVE-2020-36983 · Other software · Pablosoftwaresolutions · reported by VulnCheckHigh 8.5
Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during service startup. Attackers can exploit the misconfigured service binary path to inject malicious executables with elevated LocalSystem privileges during system boot or service restart.
- Product
- Quick 'n Easy FTP Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.compablosoftwaresolutions.com
Jan 24, 2026Star Review Manager: Cross-Site Request ForgeryCVE-2026-1076 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's CSS settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Star Review Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Star Review Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outsidCVE-2025-67124 · Other software · Svenstaro · reported by MITREMedium 6.8
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
- Product
- Miniserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 22, 2026Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability.CVE-2026-0759 · Other software · Katana Network · reported by zdi-disclosures@trendmicro.comCritical 9.8
Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeCommand method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27786.
- Product
- Development Starter Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15351 · Other software · Anritsu · reported by zdi-disclosures@trendmicro.comHigh 7.8
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27040.
- Product
- VectorStar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15350 · Other software · Anritsu · reported by zdi-disclosures@trendmicro.comHigh 7.8
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27039.
- Product
- VectorStar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 aCVE-2026-22281 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 aCVE-2026-22280 · Other software · Dell · reported by security_alert@emc.comMedium 5
Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains an incorrect permission assignment for critical resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functioCVE-2026-1332 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twMedium 6.9
MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functions and obtain meeting-related information.
- Product
- MeetingHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shelCVE-2026-1331 · Other software · AMASTAR Technology · reported by twcert@cert.org.twCritical 9.3
MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- MeetingHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 22, 2026MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path TraversCVE-2026-1330 · Other software · HAMASTAR Technology · reported by twcert@cert.org.twHigh 8.7
MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
- Product
- MeetingHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 21, 2026Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface.CVE-2021-47858 · Other software · Genexis · reported by VulnCheckMedium 5.1
Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. Attackers can inject malicious scripts through the start source address field that will persist and trigger for privileged users when they access the security management page.
- Product
- Platinum-4410
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgenexis.euexploit-db.com
Jan 21, 2026Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak permCVE-2021-47852 · Other software · Rockstar Games · reported by VulnCheckHigh 8.5
Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak permissions. Attackers can replace the RockstarService.exe with a malicious binary to create a new administrator user and gain elevated system access.
- Product
- Rockstar Games Launcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsocialclub.rockstargames.comexploit-db.com
Jan 21, 2026The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to injecCVE-2025-57681 · Other software · Thestarware · reported by MITREMedium 5.4
The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field
- Product
- Worklogpro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarketplace.atlassian.comthestarware.atlassian.net
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9466 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9465 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9464 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP classes, which causes the CIP port to become unresponsive.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9283 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9282 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9281 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device reboots
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9280 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requiring a reboot.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9279 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 20, 2026A security issue exists within ArmorStart® LT that can result in a denial-of-service condition.CVE-2025-9278 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP connectivity, causing the web application to become inaccessible.
- Product
- ArmorStart® LT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Jan 15, 2026Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disruptiCVE-2026-22909 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physCVE-2025-65397 · Other software · Blurams · reported by MITREMedium 6.8
An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to the device to execute arbitrary commands with root privileges, if file /opt/images/public_key.der is not present in the file system. The vulnerability can be triggered by providing a maliciously crafted auth.ini file on the device's SD card.
- Product
- Dome Flare Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACVE-2025-71118 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace if it is not there") fixed the situation when both start_node and acpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed on Honor Magicbook 14 Pro [1]. That happens due to the access to the member of parent_node in acpi_ns_get_next_node(). The NULL pointer dereference will always happen, no matter whether or not the start_node is equal to ACPI_ROOT_OBJECT, so move the check of start_node being NULL out of the if block. Unfortunately, all the attempts to contact Honor have failed, they refused to provide any technical support for Linux. The bad DSDT table's dump could be found on GitHub [2]. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 [ rjw: Subject adjustment, changelog edits ]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 7, 2026An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication.CVE-2025-61939 · Other software · Columbia Weather Systems · reported by ics-cert@hq.dhs.govHigh 8.7
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.
- Product
- MicroServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Memory corruption while passing pages to DSP with an unaligned starting address.CVE-2025-47388 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while passing pages to DSP with an unaligned starting address.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Starred Review: Reflected Cross-Site ScriptingCVE-2025-14118 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Starred Review
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Starred Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026Five Star Restaurant Reservations: Authorization Bypass Through User-Controlled KeyCVE-2025-68044 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nentCVE-2025-68763 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers. Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 30, 2025When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionCVE-2025-14986 · Other software · Temporal · reported by security@temporal.ioLow 1.3
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
- Product
- Temporal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025FiveStar: Authorization Bypass Through User-Controlled KeyCVE-2025-69032 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.
- Product
- FiveStar
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update FiveStar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper CVE-2019-25250 · Other software · devolo AG · reported by VulnCheckMedium 5.1
Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that trigger unauthorized configuration changes by exploiting predictable URL actions when a logged-in user visits the site.
- Product
- dLAN 550 duo+ Starter Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolo.comexploit-db.com
Dec 24, 2025devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI scrCVE-2019-25249 · Other software · devolo AG · reported by VulnCheckHigh 8.7
devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration parameters.
- Product
- dLAN 550 duo+ Starter Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolo.comexploit-db.com
Dec 24, 2025Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-43876 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.7
Under certain circumstances a successful exploitation could result in access to the device.
- Product
- iSTAR Ultra, iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 24, 2025Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-43875 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.7
Under certain circumstances a successful exploitation could result in access to the device.
- Product
- iSTAR Ultra, iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 24, 2025Five Star Restaurant Reservations: Cross-Site Request Forgery (CSRF)CVE-2025-68601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.