Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Oct 10, 2026PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying aCVE-2026-108555 · Other software · schlagmichdoch · reported by VulnCheckLow 2.3
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
- Product
- PairDrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO: Unauthorized modification of dataCVE-2025-11773 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed.
- Product
- Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO: Unauthenticated and unauthorized modification of dataCVE-2025-11771 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.
- Product
- Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025WP Airdrop Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49053 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.
- Product
- WP Airdrop Manager
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Airdrop Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2020An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token.CVE-2019-15078 · Other software · Xbornid · reported by MITREHigh 7.5
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free.
- Product
- Xbornid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2019The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of tCVE-2018-18425 · Other software · Primeo Project · reported by MITREMedium 6.5
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
- Product
- Primeo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordetherscan.iojianshu.com
Mar 15, 2019The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a cCVE-2019-9832 · Other software · Airdrop Project · reported by MITREHigh 7.5
The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.
- Product
- Airdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comyoutube.com
Jul 9, 2018The mintToken function of a smart contract implementation for NetkillerAdvancedTokenAirDrop, an Ethereum token, has an integer overflow that allows the owner ofCVE-2018-13761 · Other software · Netkilleradvancedtokenairdrop Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for NetkillerAdvancedTokenAirDrop, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Netkilleradvancedtokenairdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for AirdropperCryptics, an Ethereum token, has an integer overflow that allows the owner of the contraCVE-2018-13623 · Other software · Cryptics · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for AirdropperCryptics, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Airdroppercryptics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.