Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

18 results

Aug 1, 2025It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the liCVE-2025-8454 · Other software · Debian · reported by security@debian.orgCritical 9.8
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
Product
devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org
Dec 3, 2019An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.CVE-2013-7325 · Other software · Debian · reported by MITREHigh 8.8
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com bugzilla.redhat.com
Jul 1, 2018scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configurationCVE-2018-13043 · Other software · Debian · reported by MITRECritical 9.8
scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org usn.ubuntu.com
Sep 25, 2017scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.CVE-2015-5704 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 7.8
scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Sep 6, 2017Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.CVE-2015-5705 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 7.5
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Feb 5, 2014Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a sCVE-2014-1833 · Other software · Devscripts Devel Team · reported by MITREMedium 5
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org osvdb.org
Jan 7, 2014Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.CVE-2013-6888 · Other software · Devscripts Devel Team · reported by MITREHigh 7.5
Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org marc.info
Dec 14, 2013Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.CVE-2013-7085 · Other software · Devscripts Devel Team · reported by MITREMedium 5.8
Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org osvdb.org
Dec 13, 2013The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commaCVE-2013-7050 · Other software · Devscripts Devel Team · reported by MITREMedium 6.8
The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org bugs.debian.org
Sep 30, 2012scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on CVE-2012-3500 · Other software · Devscripts Devel Team · reported by Red HatLow 1.2
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org git.fedorahosted.org
Sep 30, 2012scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguCVE-2012-2242 · Other software · Devscripts Devel Team · reported by security@debian.orgMedium 6.8
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com debian.org
Sep 30, 2012scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to aCVE-2012-2241 · Other software · Devscripts Devel Team · reported by security@debian.orgMedium 5
scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org secunia.com
Sep 30, 2012scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to externalCVE-2012-2240 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 7.5
scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com debian.org
Jun 15, 2012debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file nCVE-2012-0212 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 9.3
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org secunia.com
Jun 15, 2012debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in theCVE-2012-0211 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 9.3
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org anonscm.debian.org
Jun 15, 2012debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the CVE-2012-0210 · Other software · Devscripts Devel Team · reported by security@debian.orgHigh 9.3
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record anonscm.debian.org secunia.com
Sep 4, 2009Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on dCVE-2009-2946 · Other software · Devscripts Devel Team · reported by MITREHigh 9.3
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
Product
Devscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org svn.debian.org
Feb 22, 2006Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-FCVE-2006-0852 · Other software · Devscripts · reported by MITREHigh 7.5
Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php.
Product
Admbook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.