Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
68 results · page 1 of 2
Oct 12, 2026Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files viCVE-2026-109316 · Other software · getgrav · reported by VulnCheckMedium 6.9
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.
- Product
- grav-plugin-data-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 29, 2026A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attaCVE-2026-84154 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 9.9
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
- Product
- GEOVIA Geospatial Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2026The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/CVE-2026-100673 · Other software · getgrav · reported by VulnCheckHigh 8.4
The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5.
- Product
- grav-plugin-datamanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API.CVE-2026-74769 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API.CVE-2026-74768 · Other software · Dell · reported by security_alert@emc.comMedium 4.1
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent.CVE-2026-73600 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability.CVE-2026-68860 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.CVE-2026-69419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.5
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
- Product
- Azure Data Manager for Energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM.CVE-2026-49499 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.CVE-2026-46738 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.CVE-2026-46737 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST ACVE-2026-44276 · Other software · Dell · reported by security_alert@emc.comMedium 6
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability.CVE-2026-40714 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API.CVE-2026-40712 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.CVE-2026-22268 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.CVE-2026-22267 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST APCVE-2026-22266 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST APCVE-2026-22269 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The Tarkov Data Manager is a tool to manage the Tarkov item data.CVE-2026-21856 · Other software · the-hideout · reported by GitHubHigh 7.2
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vulnerability in the webhook edit and scanner api endpoints that allow an authenticated attacker to execute arbitrary SQL queries against the MySQL database. Commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8 contains a patch.
- Product
- tarkov-data-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The Tarkov Data Manager is a tool to manage the Tarkov item data.CVE-2026-21855 · Other software · the-hideout · reported by GitHubCritical 9.3
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of a victim's browser session by crafting a malicious URL. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.
- Product
- tarkov-data-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The Tarkov Data Manager is a tool to manage the Tarkov item data.CVE-2026-21854 · Other software · the-hideout · reported by GitHubCritical 9.8
The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows any unauthenticated user to gain full admin access to the Tarkov Data Manager admin panel by exploiting a JavaScript prototype property access vulnerability, combined with loose equality type coercion. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.
- Product
- tarkov-data-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability.CVE-2025-43938 · Other software · Dell · reported by security_alert@emc.comMedium 5
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to gain unauthorized access with privileges of the compromised account.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability.CVE-2025-43888 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability.CVE-2025-43887 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability.CVE-2025-43886 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS CommandCVE-2025-43885 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS CommandCVE-2025-43884 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability.CVE-2025-43725 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager.CVE-2025-30480 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability.CVE-2025-23377 · Other software · Dell · reported by security_alert@emc.comMedium 4.2
Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to inject arbitrary web script or html in reporting outputs.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vuCVE-2025-23376 · Other software · Dell · reported by security_alert@emc.comLow 2.3
Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.
- Product
- PowerProtect Data Manager Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability.CVE-2025-23375 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41796 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41795 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device administrator to click on a malicious link.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41794 · Other software · Siemens · reported by productcert@siemens.comCritical 10
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793).
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41793 · Other software · Siemens · reported by productcert@siemens.comHigh 7.7
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device via ssh.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41792 · Other software · Siemens · reported by productcert@siemens.comCritical 9.2
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41791 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report creation requests. This could allow an unauthenticated remote attacker to read or clear the log files on the device, reset the device or set the date and time.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41790 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41789 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Apr 8, 2025A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).CVE-2024-41788 · Other software · Siemens · reported by productcert@siemens.comCritical 9.4
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
- Product
- SENTRON 7KT PAC1260 Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Mar 7, 2025Post Meta Data Manager: Multisite privilege escalationCVE-2024-13835 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.
- Product
- Post Meta Data Manager
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 31, 2024DM5500 5.16.0.0, contains an information disclosure vulnerability.CVE-2024-37135 · Other software · Dell · reported by security_alert@emc.comLow 3.3
DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- Data Manager Appliance Software (DMAS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024Post Meta Data Manager: Stored Cross-Site ScriptingCVE-2024-6264 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post Meta Data Manager
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 8, 2024Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability.CVE-2024-24908 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. A remote attacker with high privileges could potentially exploit this vulnerability to deletion of arbitrary files stored on the server filesystem.
- Product
- Data Manager Appliance Software (DMAS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability.CVE-2024-22460 · Other software · Dell · reported by security_alert@emc.comLow 2.2
Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability. A remote attacker with high privileges could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
- Product
- Data Manager Appliance Software (DMAS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability.CVE-2024-25971 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024 Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords.CVE-2024-22454 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024 Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability.CVE-2024-22445 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.
- Product
- PowerProtect Data Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023 Dell DM5500 contains a path traversal vulnerability in the appliance.CVE-2023-44306 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell DM5500 contains a path traversal vulnerability in the appliance. A remote attacker with high privileges could potentially exploit this vulnerability to overwrite configuration files stored on the server filesystem.
- Product
- Dell PowerProtect Data Manager DM5500 Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.