Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Jun 25, 2026In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can resuCVE-2026-12921 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 8.4
In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can resuCVE-2026-12390 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 8.4
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past tCVE-2025-66590 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 8.4
In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past theCVE-2025-66589 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 8.4
In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to cause the program to read data past the end of an allocated buffer. This could allow an attacker to disclose information or cause a system crash.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which can lead to arbitrary cCVE-2025-66588 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 8.4
In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while CVE-2025-66586 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 7.3
In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctCVE-2025-66585 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 7.3
In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack.CVE-2021-42701 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govMedium 5
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 5, 2021The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP.CVE-2021-42699 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govMedium 5.7
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 5, 2021Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects CVE-2021-42698 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 7.8
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Nov 5, 2021The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and sysCVE-2021-42543 · Other software · AzeoTech · reported by ics-cert@hq.dhs.govHigh 7.8
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
- Product
- DAQFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Sep 8, 2017An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1.CVE-2017-5147 · Other software · Azeotech · reported by ics-cert@hq.dhs.govMedium 5.3
An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has been identified, which may execute malicious DLL files that have been placed within the search path.
- Product
- Daqfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Sep 8, 2017An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1.CVE-2017-12699 · Other software · Azeotech · reported by ics-cert@hq.dhs.govHigh 7.1
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
- Product
- Daqfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Sep 16, 2011Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrarCVE-2011-3492 · Other software · Azeotech · reported by MITREHigh 10
Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted NETB packet to UDP port 20034.
- Product
- Daqfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgosvdb.org
Jul 28, 2011AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (syCVE-2011-2956 · Other software · Azeotech · reported by MITREHigh 7.8
AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.
- Product
- Daqfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordazeotech.comus-cert.gov
Dec 30, 2009Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated bCVE-2009-4480 · Other software · Azeotech · reported by MITREHigh 9.3
Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
- Product
- Daqfactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintevydis.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.