Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38 results
Aug 24, 2026A security flaw has been discovered in alibaba-fusion next up to 1.27.34.CVE-2026-78180 · Other software · alibaba-fusion · reported by VulDBMedium 6.9
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.
- Product
- next
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2026A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43.CVE-2026-19339 · Other software · aliyun · reported by VulDBLow 2.1
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- alibabacloud-dataworks-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpCVE-2026-9680 · Other software · Alibaba · reported by alibaba-cna@list.alibaba-inc.comMedium 5.8
Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.
- Product
- Alibaba Cloud RDS OpenAPI MCP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83.CVE-2026-16723 · Other software · Alibaba · reported by alibaba-cna@list.alibaba-inc.comCritical 9
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentCVE-2026-33359 · Other software · Meari · reported by 44488dab-36db-4358-99f9-bc116477f914High 7.5
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.
- Product
- Alibaba OSS Hosted
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com,CVE-2025-15573 · Other software · SolaX Power · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.4
The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.
- Product
- Pocket WiFi 3.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may beCVE-2025-70974 · Other software · Alibaba · reported by MITRECritical 10
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadinCVE-2025-2394 · Other software · Ecovacs · reported by vdp@themissinglink.com.auMedium 4.7
Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
- Product
- Ecovacs Mobile and Android Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordecovacs.comthemissinglink.com.au
Oct 21, 2024In the Linux kernel, the following vulnerability has been resolved: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing The alibaba_uncore_pmu drivCVE-2024-47731 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing The alibaba_uncore_pmu driver forgot to clear all interrupt status in the interrupt processing function. After the PMU counter overflow interrupt occurred, an interrupt storm occurred, causing the system to hang. Therefore, clear the correct interrupt status in the interrupt handling function to fix it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 26, 2024Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possiblyCVE-2024-45843 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write CVE-2024-44067 · Other software · alibaba · reported by MITREHigh 8.4
The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations, aka GhostWrite.
- Product
- t-head_xuantie_c910
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter CVE-2020-21699 · Other software · Alibaba · reported by MITREHigh 7.5
The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests.
- Product
- Tengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.CVE-2023-39106 · Other software · Alibabacloud · reported by MITREHigh 8.8
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
- Product
- Nacos Spring Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022aliyun-oss-client is a rust client for Alibaba Cloud OSS.CVE-2022-39397 · Other software · tu6ge · reported by GitHubMedium 5.6
aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.
- Product
- oss-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change CVE-2021-43116 · Other software · Alibaba · reported by MITREHigh 8.8
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
- Product
- Nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2022The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whicCVE-2022-25845 · Other software · Alibaba · reported by report@snyk.ioHigh 8.1
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crCVE-2022-25842 · Other software · Alibabagroup · reported by report@snyk.ioMedium 6.9
All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.
- Product
- One-java-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.CVE-2021-44667 · Other software · Alibaba · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
- Product
- Nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2021In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.CVE-2021-33800 · Other software · Alibaba · reported by alibaba-cna@list.alibaba-inc.comHigh 7.5
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
- Product
- Druid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.alibaba.comsecurity.alibaba.com
Aug 13, 2021The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.CVE-2021-38621 · Other software · Netless · reported by MITRECritical 9.1
The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.
- Product
- Flat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1.CVE-2020-23768 · Websites & servers · Phpyun · reported by MITREHigh 7.5
An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1. If exploited, this vulnerability will allow attackers to obtain users' personally identifiable information including e-mail address and telephone numbers.
- Product
- Phpyun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2021Nacos is a platform designed for dynamic service discovery and configuration and service management.CVE-2021-29442 · Other software · alibaba · reported by GitHubHigh 8.6
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
- Product
- nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2021Nacos is a platform designed for dynamic service discovery and configuration and service management.CVE-2021-29441 · Other software · alibaba · reported by GitHubHigh 8.6
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
- Product
- nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2020Nacos 1.1.4 is affected by: Incorrect Access Control.CVE-2020-19676 · Other software · Alibaba · reported by MITREMedium 5.3
Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)
- Product
- Nacos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a craCVE-2017-18349 · Other software · Alibaba · reported by MITRECritical 9.8
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comgithub.com
Feb 23, 2018Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.CVE-2018-6867 · Other software · Alibaba Clone Script Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.
- Product
- Alibaba Clone Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgithub.com
Sep 20, 2014The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2014-5976 · Other software · Alibaba · reported by cret@cert.orgMedium 5.4
The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Alibaba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 27, 2011SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.CVE-2010-4849 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.
- Product
- Alibaba Clone B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
May 6, 2010SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-1744 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- B2b Gold Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org
May 6, 2010SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-1726 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Ec21 Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
May 6, 2010SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2010-1725 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Alibaba Clone Platinum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Sep 30, 2009SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-3504 · Other software · Alibabaclone · reported by MITREHigh 7.5
SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Alibaba Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jul 13, 2009Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID paCVE-2009-2439 · Other software · Web Development House · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php. NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
- Product
- Alibaba Clone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Feb 7, 2007The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove methCVE-2007-0827 · Other software · Alibaba · reported by MITREMedium 6.8
The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invokes the Remove method with an invalid index argument, which is used as an offset for a function call.
- Product
- Alipay Activex Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Jul 18, 2000Buffer overflow in Alibaba web server allows remote attackers to cause a denial of service via a long GET request.CVE-2000-0626 · Other software · Computer Software Manufaktur · reported by MITREMedium 5
Buffer overflow in Alibaba web server allows remote attackers to cause a denial of service via a long GET request.
- Product
- Alibaba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Dec 31, 1999genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext.CVE-1999-1444 · Other software · Computer Software Manufaktur · reported by MITREMedium 5
genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext.
- Product
- Alibaba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcatless.ncl.ac.ukcatless.ncl.ac.uk
Nov 3, 1999Alibaba web server allows remote attackers to execute commands via a pipe character in a malformed URL.CVE-1999-0885 · Other software · Computer Software Manufaktur · reported by MITRELow 3.6
Alibaba web server allows remote attackers to execute commands via a pipe character in a malformed URL.
- Product
- Alibaba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 12, 1999Alibaba HTTP server allows remote attackers to read files via a ..CVE-1999-0776 · Other software · Computer Software Manufaktur · reported by MITREMedium 5
Alibaba HTTP server allows remote attackers to read files via a .. (dot dot) attack.
- Product
- Alibaba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordntbugtraq.comntbugtraq.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.