Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Jun 9, 2026A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low priviCVE-2026-6445 · Other software · Everpure · reported by psirt@purestorage.comHigh 8.7
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Jun 9, 2026A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyoCVE-2026-6444 · Other software · Everpure · reported by psirt@purestorage.comHigh 8.6
A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Apr 14, 2026Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.CVE-2026-0209 · Other software · PureStorage · reported by psirt@purestorage.comMedium 6.9
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Sep 23, 2024A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.CVE-2024-0004 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.1
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privilegedCVE-2024-0003 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.1
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.CVE-2024-0002 · Other software · PureStorage · reported by psirt@purestorage.comCritical 10
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor tCVE-2024-0001 · Other software · Pure Storage · reported by psirt@purestorage.comCritical 10
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.CVE-2023-36628 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 8.8
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMCVE-2023-32572 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incluCVE-2023-28373 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 4.4
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.