Updated 28 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

55 results · page 1 of 2

Oct 1, 2026HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured.CVE-2026-21833 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output.CVE-2026-21832 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive informaCVE-2025-62318 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation.CVE-2025-62315 · Other software · HCL Software · reported by psirt@hcl.comLow 3.4
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls.CVE-2025-62314 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.6
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 13, 2026HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation.CVE-2025-52640 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.CVE-2025-62317 · Other software · HCL · reported by psirt@hcl.comLow 2.6
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured.CVE-2025-62316 · Other software · HCL · reported by psirt@hcl.comLow 2.3
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls and could expose the application to limited security risks under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.CVE-2025-62313 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication.CVE-2025-62312 · Other software · HCL · reported by psirt@hcl.comLow 3
HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practices.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.CVE-2025-62311 · Other software · HCL · reported by psirt@hcl.comMedium 4.3
HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations.CVE-2025-62310 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.CVE-2025-62309 · Other software · HCL · reported by psirt@hcl.comLow 2.6
HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed.CVE-2025-62308 · Other software · HCL · reported by psirt@hcl.comMedium 5.1
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 14, 2026HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitiCVE-2025-62305 · Other software · HCL · reported by psirt@hcl.comMedium 5.1
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 15, 2026HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures.CVE-2025-52641 · Other software · HCL · reported by psirt@hcl.comLow 2.9
HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.CVE-2025-52649 · Other software · HCL · reported by psirt@hcl.comLow 1.8
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.CVE-2025-52646 · Other software · HCL · reported by psirt@hcl.comLow 2.2
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.CVE-2025-52645 · Other software · HCL · reported by psirt@hcl.comLow 1.9
HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification. This may allow the possibility of unverified or modified model artifacts being used, potentially leading to integrity concerns or unintended behaviour.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged.CVE-2025-52644 · Other software · HCL · reported by psirt@hcl.comMedium 5.8
HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment.CVE-2025-52643 · Other software · HCL · reported by psirt@hcl.comMedium 4.7
HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact when processing specially crafted files.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour.CVE-2025-52642 · Other software · HCL · reported by psirt@hcl.comLow 3.3
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability related to the handling of upload size limits.CVE-2025-52636 · Other software · HCL · reported by psirt@hcl.comLow 1.8
HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may allow excessive resource consumption, which could potentially lead to service degradation or denial-of-service conditions under certain scenarios.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where offering images are not digitally signed.CVE-2025-52648 · Other software · HCL · reported by psirt@hcl.comMedium 4.8
HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges.CVE-2025-52638 · Other software · HCL · reported by psirt@hcl.comMedium 5.6
HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with security best practices requires minimizing privileges and avoiding root-level execution wherever possible.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Mar 16, 2026HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.CVE-2025-52637 · Other software · HCL · reported by psirt@hcl.comMedium 4.5
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability.CVE-2025-52633 · Other software · HCL · reported by psirt@hcl.comLow 3.1
HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability.CVE-2025-52631 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability.CVE-2025-52628 · Other software · HCL · reported by psirt@hcl.comMedium 4.6
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability.CVE-2025-52623 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026HCL AION is susceptible to Missing Content-Security-Policy.CVE-2025-52629 · Other software · HCL · reported by psirt@hcl.comLow 3.7
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026Root File System Not Mounted as Read-Only configuration vulnerability.CVE-2025-52627 · Other software · HCL · reported by psirt@hcl.comMedium 5.5
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Feb 3, 2026A Potential Command Injection vulnerability in HCL AION.CVE-2025-52626 · Other software · HCL · reported by psirt@hcl.comMedium 4.5
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Weak Password Policy vulnerability.CVE-2025-55252 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Technical Error Disclosure vulnerability.CVE-2025-55250 · Other software · HCL Software · reported by psirt@hcl.comLow 1.8
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION is affected by an Unrestricted File Upload vulnerability.CVE-2025-55251 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION is affected by a Missing Security Response Headers vulnerability.CVE-2025-55249 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability.CVE-2025-52661 · Other software · HCL Software · reported by psirt@hcl.comLow 2.4
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION is affected by an Unrestricted File Upload vulnerability.CVE-2025-52660 · Other software · HCL Software · reported by psirt@hcl.comLow 2.7
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jan 19, 2026HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability.CVE-2025-52659 · Other software · HCL Software · reported by psirt@hcl.comLow 2.8
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.CVE-2025-52635 · Other software · HCL · reported by psirt@hcl.comLow 3.7
A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION.CVE-2025-52625 · Other software · HCL · reported by psirt@hcl.comLow 3.7
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A vulnerability Bypass of the script allowlist configuration in HCL AION.CVE-2025-52624 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0CVE-2025-52650 · Other software · HCL · reported by psirt@hcl.comHigh 8.2
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
Product
HCL AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.CVE-2025-52634 · Other software · HCL · reported by psirt@hcl.comLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
Product
HCL AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52632 · Other software · HCL · reported by psirt@hcl.comMedium 6.5
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52630 · Other software · HCL · reported by psirt@hcl.comLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 29, 2025A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3.CVE-2025-9654 · Other software · AiondaDotCom · reported by VulDBMedium 5.3
A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve this issue. The patch is named cd2566a948b696501abfa6c6b03462cac5fb43d8. It is advisable to upgrade the affected component.
Product
mcp-ssh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2024A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located CVE-2023-49351 · Other software · Edimax · reported by MITRECritical 9.8
A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located on the stack due to an incorrect use of the strcpy() function.
Product
Br-6478ac Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
Product
Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
Fixed in
3.7.0.1
What to do
Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.