Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

28 results

Mar 24, 2026Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329.CVE-2026-4752 · Other software · No-Chicken · reported by cve_disclosure@tech.gov.sgMedium 6.4
Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329.
Product
Echo-Mate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 24, 2026Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules).CVE-2026-4737 · Other software · No-Chicken · reported by cve_disclosure@tech.gov.sgHigh 7.3
Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules). This vulnerability is associated with program files rmap.C‎. This issue affects Echo-Mate: before V250329.
Product
Echo-Mate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 24, 2026Improper Handling of Values vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/include/net/netfilter modules).CVE-2026-4736 · Other software · No-Chicken · reported by cve_disclosure@tech.gov.sgHigh 7.3
Improper Handling of Values vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/include/net/netfilter modules). This vulnerability is associated with program files nf_tables.H‎, nft_byteorder.C‎, nft_meta.C‎. This issue affects Echo-Mate: before V250329.
Product
Echo-Mate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Dec 18, 2024Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlierCVE-2024-54457 · Other software · FXC Inc. · reported by vultures@jpcert.or.jpHigh 7.2
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
Product
AE1021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp fxc.jp
Dec 5, 2024Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier.CVE-2024-52564 · Other software · I-O DATA DEVICE, INC. · reported by vultures@jpcert.or.jpHigh 7.5
Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered.
Product
UD-LT1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp iodata.jp
Jun 12, 2023An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.CVE-2023-27716 · Other software · Kafkaui-lite Project · reported by MITRECritical 9.8
An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.
Product
Kafkaui-lite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 10, 2022egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.CVE-2022-45145 · Other software · Call-cc · reported by MITRECritical 9.8
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.call-cc.org code.call-cc.org
Nov 22, 2019Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.CVE-2014-6310 · Other software · Call-cc · reported by MITRECritical 9.8
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Oct 31, 2019Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause CVE-2013-2075 · Other software · chicken · reported by Red HatHigh 8.8
Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for CVE-2012-6122.
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.call-cc.org code.call-cc.org
Oct 31, 2019Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.CVE-2012-6125 · Other software · chicken · reported by Red HatCritical 9.8
Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com access.redhat.com
Oct 31, 2019A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value.CVE-2012-6124 · Other software · chicken · reported by Red HatMedium 5.3
A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com access.redhat.com
Oct 31, 2019Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."CVE-2012-6123 · Other software · chicken · reported by Red HatMedium 6.5
Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com access.redhat.com
Oct 31, 2019Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a largCVE-2012-6122 · Other software · chicken · reported by Red HatHigh 7.5
Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value.
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.gnu.org openwall.com
Oct 31, 2019OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.CVE-2013-2024 · Other software · chicken · reported by Red HatHigh 8.8
OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.
Product
chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jul 17, 2017Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack.CVE-2017-11343 · Other software · Call-cc · reported by MITREHigh 7.5
Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, will result in O(n) lookup time.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.gnu.org lists.gnu.org
Jun 1, 2017An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows CVE-2017-9334 · Other software · Call-cc · reported by MITREHigh 7.5
An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause a denial of service by passing an improper list to an application that calls "length" on it.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.nongnu.org lists.nongnu.org
Mar 29, 2017The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).CVE-2015-4556 · Other software · Call-cc · reported by MITREHigh 7.5
The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.nongnu.org lists.nongnu.org
Mar 16, 2017An issue was discovered in CHICKEN Scheme through 4.12.0.CVE-2017-6949 · Other software · Call-cc · reported by MITREHigh 8.1
An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory, the vector size would be used in unsanitised form as an argument to malloc(). With an unexpected size, the impact may have been a segfault or buffer overflow.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.gnu.org securityfocus.com
Jan 10, 2017The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak.CVE-2016-6831 · Other software · Call-cc · reported by Red HatHigh 7.5
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.nongnu.org securityfocus.com
Jan 10, 2017The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in itsCVE-2016-6830 · Other software · Call-cc · reported by Red HatCritical 9.8
The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call. This would allow user-supplied argument/environment variable lists to trigger a buffer overrun. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0, which are not yet released).
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.nongnu.org securityfocus.com
Aug 28, 2015Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument CVE-2014-9651 · Other software · Call-cc · reported by MITREHigh 7.5
Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index[-ci] procedures."
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.nongnu.org lists.nongnu.org
Sep 29, 2014Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current workingCVE-2013-1874 · Other software · Call-cc · reported by Red HatMedium 4.4
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.call-cc.org seclists.org
Sep 9, 2014The Ninja Chicken Ooga Booga (aka mominis.Generic_Android.Ninja_Chicken_Ooga_Booga) application 1.4.2 for Android does not verify X.509 certificates from SSL seCVE-2014-5789 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken Ooga Booga (aka mominis.Generic_Android.Ninja_Chicken_Ooga_Booga) application 1.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Ninja Chicken Ooga Booga
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 9, 2014The Ninja Chicken Adventure Island (aka mominis.Generic_Android.Ninja_Chicken_Adventure_Island) application 1.1.1 for Android does not verify X.509 certificatesCVE-2014-5788 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken Adventure Island (aka mominis.Generic_Android.Ninja_Chicken_Adventure_Island) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Ninja Chicken Adventure Island
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Sep 9, 2014The Ninja Chicken (aka mominis.Generic_Android.Ninja_Chicken) application 1.7.6 for Android does not verify X.509 certificates from SSL servers, which allows maCVE-2014-5787 · Other software · Playscape · reported by cret@cert.orgMedium 5.4
The Ninja Chicken (aka mominis.Generic_Android.Ninja_Chicken) application 1.7.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Ninja Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
May 20, 2014Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers toCVE-2014-3776 · Other software · Call-cc · reported by MITREHigh 7.5
Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.call-cc.org lists.gnu.org
Oct 9, 2013Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attacCVE-2013-4385 · Other software · Call-cc · reported by Red HatHigh 7.5
Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
Product
Chicken
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.gnu.org lists.nongnu.org
Feb 5, 2007Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large computer-name size value in a ServerInit packCVE-2007-0756 · Other software · Chicken Of The VNC · reported by MITREHigh 7.8
Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large computer-name size value in a ServerInit packet, which triggers a failed malloc and a resulting NULL dereference.
Product
Chicken Of The VNC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityreason.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.