Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

333new WordPress flaws this week

390,007entries in the database

42 results

Apr 15, 2025An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-31950 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can obtain other users' charger information.CVE-2025-31945 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain other users' charger information.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-31654 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-31360 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31147 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).CVE-2025-30512 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An attacker can upload an arbitrary file instead of a plant image.CVE-2025-30510 · Other software · Growatt · reported by ics-cert@hq.dhs.govCritical 9.3
An attacker can upload an arbitrary file instead of a plant image.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.CVE-2025-30257 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.CVE-2025-27929 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.CVE-2025-27927 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27719 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can query an API endpoint and get device details.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-27575 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.CVE-2025-27565 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can rename "rooms" of arbitrary users.CVE-2025-27561 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename "rooms" of arbitrary users.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).CVE-2025-26857 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-25276 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can hijack other users' devices and potentially control them.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An attacker can export other users' plant information.CVE-2025-24850 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can export other users' plant information.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).CVE-2025-24315 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.CVE-2025-24297 · Other software · Growatt · reported by ics-cert@hq.dhs.govCritical 9.3
Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An authenticated attacker can obtain any plant name by knowing the plant ID.CVE-2025-31949 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An authenticated attacker can obtain any plant name by knowing the plant ID.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.CVE-2025-31941 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can check the existence of usernames in the system by querying an API.CVE-2025-31933 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can obtain a user's plant list by knowing the username.CVE-2025-31357 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a user's plant list by knowing the username.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").CVE-2025-30514 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.CVE-2025-30511 · Other software · Growatt · reported by ics-cert@hq.dhs.govHigh 8.7
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.CVE-2025-30254 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An attacker can change registered email addresses of other users and take over arbitrary accounts.CVE-2025-27939 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can change registered email addresses of other users and take over arbitrary accounts.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-27938 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can get users' emails by knowing usernames.CVE-2025-27568 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 15, 2025An unauthenticated attacker can infer the existence of usernames in the system by querying an API.CVE-2025-24487 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
Product
Cloud portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Oct 19, 2021InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements tCVE-2021-38486 · Other software · InHand Networks · reported by ics-cert@hq.dhs.govHigh 8
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to which the product is connected.
Product
IR615 Router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
May 5, 2020The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated.CVE-2020-12144 · Other software · Silver Peak Systems, Inc. · reported by sirt@silver-peak.comMedium 6
The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal.
Product
1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator  3. EdgeConnect in AWS, Azure, GCP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record silver-peak.com silver-peak.com
Jun 17, 2015Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectCVE-2015-4190 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Aug 30, 2014Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL sessioCVE-2014-3352 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh84801.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com tools.cisco.com
Aug 29, 2014Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote CVE-2014-3351 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com tools.cisco.com
Aug 29, 2014Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly implement URL redirection, which allows remote authenticated users to obtain sCVE-2014-3350 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly implement URL redirection, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCuh84870.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Aug 29, 2014Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not validate file types during the handling of file submission, which allows remote authentCVE-2014-3349 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not validate file types during the handling of file submission, which allows remote authenticated users to upload arbitrary files via a crafted request, aka Bug ID CSCuh87410.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securityfocus.com
Jul 2, 2014Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenticated users to obtaiCVE-2014-3298 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenticated users to obtain sensitive information by reading HTML source code, aka Bug ID CSCui36976.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com tools.cisco.com
Jul 2, 2014Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticatedCVE-2014-3297 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Mar 14, 2014Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote atCVE-2014-0694 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772, CSCui34776, CSCui34798, CSCui34800, CSCui34805, CSCui34809, CSCui34810, CSCui34813, CSCui34814, and CSCui34818.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Dec 10, 2013Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889.CVE-2013-6708 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org tools.cisco.com
Feb 26, 2013The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users toCVE-2013-1139 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4
The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCud81134.
Product
Cloud Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.