Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Mar 24, 2026In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrivCVE-2026-1995 · Other software · IDrive · reported by cret@cert.orgHigh 7.8
In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.
- Product
- IDrive Cloud Backup Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Dec 2, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized accessCVE-2025-10304 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the process_status_unlink() function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to delete the back-up progress files and cause a back-up to fail while it is in progress.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized access of dataCVE-2025-11380 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025pCloud Backup: Missing AuthorizationCVE-2025-31755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pCloud Backup: from n/a through <= 1.0.1.
- Product
- pCloud Backup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update pCloud Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2024Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Sensitive Information ExposureCVE-2024-10028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 31, 2023Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52185 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 21, 2022Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options.CVE-2022-37027 · Other software · Ahsay · reported by MITREHigh 7.2
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.ahsay.comahsay.com
Jul 27, 2022A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.CVE-2022-36917 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.
- Product
- Jenkins Google Cloud Backup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.CVE-2022-36916 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8
A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.
- Product
- Jenkins Google Cloud Backup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 9, 2022Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via locaCVE-2021-0156 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0125 · Other software · Netapp · reported by secure@intel.comMedium 6.6
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0124 · Other software · Netapp · reported by secure@intel.comMedium 6.6
Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical acceCVE-2021-0119 · Other software · Netapp · reported by secure@intel.comMedium 6.2
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0118 · Other software · Netapp · reported by secure@intel.comMedium 6.7
Out-of-bounds read in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0117 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Pointer issues in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Feb 9, 2022Out-of-bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.CVE-2021-0116 · Other software · Netapp · reported by secure@intel.comHigh 7.8
Out-of-bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comintel.com
Oct 11, 2021An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6.CVE-2021-42252 · Other software · Netapp · reported by MITREHigh 7.8
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Mar 7, 2021An issue was discovered in the Linux kernel through 5.11.3.CVE-2021-27365 · Other software · Netapp · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.grimm-co.com
Mar 7, 2021An issue was discovered in the Linux kernel through 5.11.3.CVE-2021-27364 · Other software · Netapp · reported by MITREHigh 7.1
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
- Product
- Cloud Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.grimm-co.com
Jan 6, 2020An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-eCVE-2020-5846 · Other software · Ahsay · reported by MITREHigh 8.8
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full system access as the configured user (e.g., Administrator) when starting from any authenticated session (e.g., a trial account). This is fixed in the 83/830122/cbs-*-hotfix-task26000 builds.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50.CVE-2019-10267 · Other software · Ahsay · reported by MITREHigh 8.8
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10266 · Other software · Ahsay · reported by MITREHigh 7.5
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comwbsec.nl
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10265 · Other software · Ahsay · reported by MITREHigh 7.5
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File Explorer" screen, it is possible to change the directory in the JavaScript code. If changed to (for example) "C:" then one can browse the whole server.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10264 · Other software · Ahsay · reported by MITREHigh 7.2
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "Move / Import / Export Users" screen has an Import Users option. This option accepts a ZIP archive containing a users.xml file that can trigger XXE.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.CVE-2019-10263 · Other software · Ahsay · reported by MITREMedium 6.1
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
- Product
- Cloud Backup Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.