Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

34 results

Aug 27, 2026A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerateCVE-2026-78498 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 5.1
A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems.
Product
Dimension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.watchguard.com
Oct 31, 2025Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12553 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Product
BLU-IC2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record azure-access.com
Apr 29, 2025An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below.CVE-2025-3929 · Other software · MDaemon · reported by security@eset.comMedium 5.3
An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mdaemon.com
Nov 15, 2024MDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityCVE-2024-11182 · Other software · MDaemon · reported by security@eset.comExploitedMedium 5.3
MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.
Product
Email Server
On CISA’s list since
May 19, 2025 (federal fix deadline Jun 9, 2025)
What to do
Attackers are using this now. Install MDaemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog files.mdaemon.com cisa.gov
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.CVE-2022-37238 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.CVE-2022-37245 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter.CVE-2022-37244 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.CVE-2022-37243 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.CVE-2022-37242 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.CVE-2022-37241 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.CVE-2022-37240 · Other software · Altn · reported by MITRECritical 9.8
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Aug 25, 2022MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.CVE-2022-37239 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint.
Product
Security Gateway For Email Servers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record files.mdaemon.com gtn.com.np
Mar 9, 2022Maddy Mail Server is an open source SMTP compatible email server.CVE-2022-24732 · Other software · foxcpp · reported by GitHubMedium 6.3
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
Product
maddy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.CVE-2020-14066 · Other software · Icewarp · reported by MITREHigh 8.8
IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.CVE-2020-14065 · Other software · Icewarp · reported by MITREMedium 6.5
IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Jul 15, 2020IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.CVE-2020-14064 · Other software · Icewarp · reported by MITREMedium 6.5
IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
Product
Mail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com icewarp.com
Dec 17, 2019MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.CVE-2019-19497 · Other software · Altn · reported by MITREMedium 5.4
MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
Product
Mdaemon Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com twitter.com
Jul 16, 2019MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special cCVE-2019-13612 · Other software · Altn · reported by MITREHigh 7.5
MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious e-mail, if a customer deploys a server with sufficient resources to scan large messages.
Product
Mdaemon Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.altn.com lists.altn.com
Jun 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTCVE-2012-2591 · Other software · Emailarchitect · reported by cret@cert.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) From or (2) Date field in an email.
Product
Emailarchitect Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org
May 5, 2009CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easierCVE-2009-1469 · Other software · Icewarp · reported by MITREMedium 4.3
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org redteam-pentesting.de
May 5, 2009Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4CVE-2009-1468 · Other software · Icewarp · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org redteam-pentesting.de
May 5, 2009Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web scripCVE-2009-1467 · Other software · Icewarp · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org osvdb.org
Feb 19, 2009NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.CVE-2008-6185 · Other software · Noticeware · reported by MITREMedium 5
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.
Product
Noticeware Email Server NG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Oct 8, 2008Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, whicCVE-2008-4491 · Computers, phones & browsers · Apple · reported by MITREMedium 5
Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail.
Product
Mail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record enablesecurity.com resources.enablesecurity.com
Aug 12, 2008The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long LOGIN commCVE-2008-3607 · Other software · Noticeware · reported by MITREMedium 5
The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long LOGIN commands.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securityfocus.com
Apr 9, 2008MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application crash) via a long string to IMAP port (143/tCVE-2008-1713 · Other software · Noticeware · reported by MITREMedium 5
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application crash) via a long string to IMAP port (143/tcp).
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Jun 20, 2006Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a caCVE-2006-3108 · Other software · Emailarchitect · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover attribute and its value, which bypasses the mail filter.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com securitytracker.com
Jun 12, 2006Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 6.1.0.5 and earlier allow remote attackers to inject arbitrary web script or CVE-2006-2974 · Other software · Emailarchitect · reported by MITRELow 2.6
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 6.1.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) errCode and (2) uid parameter in (a) default.asp and (3) dname parameter in (b) /admin/dns.asp and (c) /additional/regdomain_done.asp.
Product
Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Apr 20, 2006Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact andCVE-2006-1879 · Other software · Oracle · reported by MITREHigh 10
Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.
Product
Collaboration Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
May 2, 2005Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.CVE-2005-0635 · Other software · Foxmail · reported by MITREHigh 10
Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.
Product
Foxmail Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
May 2, 2005Buffer overflow in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.CVE-2005-0339 · Other software · Foxmail · reported by MITREHigh 10
Buffer overflow in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM command.
Product
Foxmail Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info securityfocus.com
Mar 2, 2005Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format stCVE-2005-0636 · Other software · Foxmail · reported by MITREHigh 10
Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the USER command.
Product
Foxmail Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Dec 31, 2004Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determCVE-2004-2150 · Other software · Nettica · reported by MITREMedium 5
Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
Product
Intellipeer Email Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Dec 31, 2002Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP porCVE-2002-2404 · Websites & servers · Curtis Specialty Consulting · reported by MITREMedium 5
Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to the POP3 port (TCP port 110).
Product
Iispop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info iss.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.