Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 11, 2026The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching CVE-2026-68067 · Other software · Quanovate Tech Inc. (operating as Mira / Mira Care) · reported by ics-cert@hq.dhs.govCritical 9.3
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.
- Product
- Mira Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version fCVE-2026-64934 · Other software · Quanovate Tech Inc. (operating as Mira / Mira Care) · reported by ics-cert@hq.dhs.govMedium 5.3
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.
- Product
- Mira Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated CVE-2026-12879 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cMedium 5.9
An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data. This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.
- Product
- Apigee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate seCVE-2026-2264 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.2
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
- Product
- Apigee-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Development and test API endpoints are present that mirror production functionality.CVE-2026-32662 · Other software · Gardyn · reported by ics-cert@hq.dhs.govMedium 6.9
Development and test API endpoints are present that mirror production functionality.
- Product
- Cloud API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Apr 3, 2026A specific administrative endpoint is accessible without proper authentication, exposing device management functions.CVE-2026-32646 · Other software · Gardyn · reported by ics-cert@hq.dhs.govHigh 8.7
A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
- Product
- Cloud API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Apr 3, 2026A specific administrative endpoint notifications is accessible without proper authentication.CVE-2026-28767 · Other software · Gardyn · reported by ics-cert@hq.dhs.govMedium 6.9
A specific administrative endpoint notifications is accessible without proper authentication.
- Product
- Cloud API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Apr 3, 2026A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.CVE-2026-28766 · Other software · Gardyn · reported by ics-cert@hq.dhs.govCritical 9.2
A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
- Product
- Cloud API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Apr 3, 2026A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.CVE-2026-25197 · Other software · Gardyn · reported by ics-cert@hq.dhs.govCritical 9.3
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
- Product
- Cloud API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Dec 4, 2025The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user canCVE-2025-13932 · Other software · SolisCloud · reported by ics-cert@hq.dhs.govHigh 8.3
The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.
- Product
- Monitoring Platform (Cloud API & Device Control API)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110.CVE-2025-32010 · Network & remote access · Tenda · reported by talos-cna@cisco.comHigh 8.1
A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.
- Product
- AC6 V5.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 25, 2025Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vCVE-2025-29631 · Other software · Gardyn · reported by MITRECritical 9.8
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
- Product
- Home Kit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Jul 25, 2025Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for CVE-2025-29629 · Other software · Gardyn · reported by MITRECritical 9.1
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
- Product
- Home Kit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commygardyn.com
Jul 9, 2025Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, incrCVE-2025-53671 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins Nouvola DiveCloud Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Jul 9, 2025Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins cCVE-2025-53670 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Nouvola DiveCloud Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Mar 18, 2025An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices.CVE-2024-23943 · Other software · MB connect line · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to CVE-2021-1582 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive, browser-based information.
- Product
- Cisco Application Policy Infrastructure Controller (APIC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 25, 2021Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote aCVE-2021-1581 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Application Policy Infrastructure Controller (APIC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 25, 2021Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote aCVE-2021-1580 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Application Policy Infrastructure Controller (APIC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Dec 31, 2018The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring.CVE-2018-18602 · Other software · Guardzilla · reported by MITRECritical 9.8
The Cloud API on Guardzilla smart cameras allows user enumeration, with resultant arbitrary camera access and monitoring.
- Product
- 360 Outdoor Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.bitdefender.comlabs.bitdefender.com
Jul 13, 2018The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.CVE-2016-6547 · Other software · Zizai Technology · reported by cret@cert.orgHigh 7.8
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
- Product
- Tech Nut Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comkb.cert.org
Jul 13, 2018The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file.CVE-2016-6546 · Other software · iTrack · reported by cret@cert.orgHigh 7.8
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext.
- Product
- Easy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblog.rapid7.com
Jul 6, 2018The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.CVE-2016-6538 · Other software · TrackR · reported by cret@cert.orgHigh 8.8
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
- Product
- Bravo Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblog.rapid7.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.