Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

23 results

Feb 2, 2026Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2026-1770 · Other software · CrafterCMS · reported by security@craftersoftware.comMedium 4.5
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).
Product
CrafterCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org
Sep 13, 2022Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2022-40635 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 6.4
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Sep 13, 2022Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2022-40634 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 6.4
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
May 16, 2022Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2021-23267 · Other software · Crafter Software · reported by security@craftersoftware.comHigh 7.6
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
May 16, 2022An anonymous user can craft a URL with text that ends up in the log viewer as is.CVE-2021-23266 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.3
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
May 16, 2022A logged-in and authenticated user with a Reviewer Role may lock a content item.CVE-2021-23265 · Other software · Crafter Software · reported by security@craftersoftware.comLow 3.5
A logged-in and authenticated user with a Reviewer Role may lock a content item.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.CVE-2021-23264 · Other software · Crafter Software · reported by security@craftersoftware.comHigh 8.1
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).CVE-2021-23263 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 5.9
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.CVE-2021-23262 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.2
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Authenticated administrators may override the system configuration file and cause a denial of service.CVE-2021-23261 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.5
Authenticated administrators may override the system configuration file and cause a denial of service.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.CVE-2021-23260 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 6.5
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage.CVE-2021-23259 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.2
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 2, 2021Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans.CVE-2021-23258 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.2
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.CVE-2017-15686 · Other software · Craftercms · reported by MITREMedium 6.1
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE).CVE-2017-15685 · Other software · Craftercms · reported by MITREHigh 8.6
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.CVE-2017-15684 · Other software · Craftercms · reported by MITREHigh 7.5
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-ofCVE-2017-15683 · Other software · Craftercms · reported by MITREHigh 8.6
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.CVE-2017-15682 · Other software · Craftercms · reported by MITREMedium 6.1
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating systCVE-2017-15681 · Other software · Craftercms · reported by MITRECritical 9.8
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Nov 27, 2020In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.CVE-2017-15680 · Other software · Craftercms · reported by MITREMedium 6.5
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Oct 6, 2020Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2020-25803 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.2
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Oct 6, 2020Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2020-25802 · Other software · Crafter Software · reported by security@craftersoftware.comMedium 4.2
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.craftercms.org docs.craftercms.org
Dec 6, 2018A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18.CVE-2018-19907 · Other software · Craftercms · reported by MITREHigh 8.8
A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
Product
Crafter CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com medium.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.