Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
May 21, 2026The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations.CVE-2026-9089 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.8
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-CVE-2026-6066 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 7.1
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations.CVE-2025-11493 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49High 8.8
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS.CVE-2025-11492 · Other software · ConnectWise · reported by 7d616e1a-3288-43b1-a0dd-0a65d3e70a49Critical 9.6
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Connectwise Automate 2022.11 is vulnerable to Cleartext authentication.CVE-2023-23130 · Other software · Connectwise · reported by MITREMedium 5.9
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's position is that, by design, this is controlled by a configuration option in which a customer can choose to use HTTP (rather than HTTPS) during troubleshooting.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Connectwise Automate 2022.11 is vulnerable to Clickjacking.CVE-2023-23126 · Other software · Connectwise · reported by MITREMedium 6.1
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.CVE-2021-35066 · Other software · Connectwise · reported by MITRECritical 9.8
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhome.connectwise.comconnectwise.com
Jun 17, 2021An issue was discovered in ConnectWise Automate before 2021.5.CVE-2021-32582 · Other software · Connectwise · reported by MITREHigh 7.5
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.
- Product
- Connectwise Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhome.connectwise.comconnectwise.com
Oct 9, 2020The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.CVE-2020-15838 · Other software · Connectwise · reported by MITREHigh 8.8
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbeta.comconnectwise.com
Jul 16, 2020ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts.CVE-2020-15027 · Other software · Connectwise · reported by MITRECritical 9.8
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This was patched in 2020.7 and in a hotfix for 2019.12.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslagle.techslagle.tech
Jul 7, 2020A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12.CVE-2020-15008 · Other software · Connectwise · reported by MITREHigh 7.5
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
- Product
- Connectwise Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslagle.techslagle.tech
Jun 15, 2020By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individualCVE-2020-14159 · Other software · Connectwise · reported by MITREHigh 8.8
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178.
- Product
- Automate API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconnectwise.comconnectwise.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.