Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-65827 · Other software · docmost · reported by GitHubMedium 6.5
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-52853 · Other software · docmost · reported by GitHubMedium 5.2
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-52850 · Other software · docmost · reported by GitHubMedium 4.3
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-48073 · Other software · docmost · reported by GitHubMedium 4.3
Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-48072 · Other software · docmost · reported by GitHubMedium 5.3
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-48070 · Other software · docmost · reported by GitHubHigh 7.1
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.CVE-2025-57231 · Other software · reported by MITREHigh 7.5
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comartresilia.com
Apr 21, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-40927 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-34213 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-34212 · Other software · docmost · reported by GitHubMedium 5.4
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-33193 · Other software · docmost · reported by GitHubMedium 4.6
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-33146 · Other software · docmost · reported by GitHubMedium 4.3
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-24045 · Other software · docmost · reported by GitHubHigh 7.3
Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Docmost is open-source collaborative wiki and documentation software.CVE-2026-23630 · Other software · docmost · reported by GitHubMedium 6.3
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Docmost is an open-source collaborative wiki and documentation software.CVE-2026-22249 · Other software · docmost · reported by GitHubHigh 7.1
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
- Product
- docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary codeCVE-2025-55574 · Other software · Docmost · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
- Product
- Docmost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.