Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Sep 24, 2026GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability.CVE-2026-97181 · Other software · ezGlobal · reported by twcert@cert.org.twMedium 6.9
GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.
- Product
- GPM LIGHT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 15, 2026Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer.CVE-2026-61449 · Other software · getgrav · reported by VulnCheckHigh 7.1
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 7, 2025GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory.CVE-2025-50675 · Other software · reported by MITREHigh 7.8
GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessible with full read, write, and execute permissions for all users, allowing unprivileged users to manipulate files within the directory, including executable files like GPMAW3.exe, Fragment.exe, and the uninstaller GPsetup64_17028.exe. An attacker with user-level access can exploit this misconfiguration by replacing or modifying the uninstaller (GPsetup64_17028.exe) with a malicious version. While the application itself runs in the user's context, the uninstaller is typically executed with administrative privileges when an administrator attempts to uninstall the software. By exploiting this flaw, an attacker could gain administrative privileges and execute arbitrary code in the context of the admin, resulting in privilege escalation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the CVE-2025-4558 · Other software · WormHole Tech · reported by twcert@cert.org.twCritical 9.3
The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system.
- Product
- GPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 16, 2024In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: don't leak PM reference in error path If gpmi_nfc_apply_timings() failCVE-2022-48778 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: don't leak PM reference in error path If gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be dropped.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 19, 2020GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_ScaledData().CVE-2020-16161 · Other software · Gopro · reported by MITREHigh 7.5
GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_ScaledData(). Parsing malicious input can result in a crash.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.inhq.netgithub.com
Oct 19, 2020GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_Decompress().CVE-2020-16160 · Other software · Gopro · reported by MITREHigh 7.5
GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_Decompress(). Parsing malicious input can result in a crash.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.inhq.netgithub.com
Oct 19, 2020GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF_ScaledData().CVE-2020-16159 · Other software · Gopro · reported by MITRECritical 9.1
GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF_ScaledData(). Parsing malicious input can result in a crash or information disclosure.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.inhq.netgithub.com
Oct 19, 2020GoPro gpmf-parser through 1.5 has a stack out-of-bounds write vulnerability in GPMF_ExpandComplexTYPE().CVE-2020-16158 · Other software · Gopro · reported by MITREHigh 8.8
GoPro gpmf-parser through 1.5 has a stack out-of-bounds write vulnerability in GPMF_ExpandComplexTYPE(). Parsing malicious input can result in a crash or potentially arbitrary code execution.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.inhq.netgithub.com
Dec 29, 2019GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation.CVE-2019-20089 · Other software · Gopro · reported by MITREHigh 7.8
GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c.CVE-2019-20088 · Other software · Gopro · reported by MITREHigh 7.8
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature.CVE-2019-20087 · Other software · Gopro · reported by MITREHigh 8.8
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.CVE-2019-20086 · Other software · Gopro · reported by MITREHigh 8.8
GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2019GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.CVE-2019-15148 · Other software · Gopro · reported by MITREMedium 6.5
GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2019GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.CVE-2019-15147 · Other software · Gopro · reported by MITREMedium 6.5
GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2019GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.CVE-2019-15146 · Other software · Gopro · reported by MITREMedium 6.5
GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018An issue was discovered in GoPro gpmf-parser 1.2.1.CVE-2018-18699 · Other software · Gopro · reported by MITREHigh 8.8
An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2018An issue was discovered in GoPro gpmf-parser before 1.2.1.CVE-2018-18190 · Other software · Gopro · reported by MITREMedium 5.5
An issue was discovered in GoPro gpmf-parser before 1.2.1. There is a divide-by-zero error in GPMF_ScaledData in GPMF_parser.c.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2018An issue was discovered in gpmf-parser 1.1.2.CVE-2018-13026 · Other software · Gopro · reported by MITRECritical 9.8
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in gpmf-parser 1.1.2.CVE-2018-13011 · Other software · Gopro · reported by MITRECritical 9.8
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in gpmf-parser 1.1.2.CVE-2018-13009 · Other software · Gopro · reported by MITRECritical 9.8
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check).
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in gpmf-parser 1.1.2.CVE-2018-13008 · Other software · Gopro · reported by MITRECritical 9.8
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level.
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in gpmf-parser 1.1.2.CVE-2018-13007 · Other software · Gopro · reported by MITRECritical 9.8
An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).
- Product
- Gpmf-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2001Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges.CVE-2001-1203 · Other software · Alessandro Rubini · reported by MITREHigh 7.2
Format string vulnerability in gpm-root in gpm 1.17.8 through 1.17.18 allows local users to gain root privileges.
- Product
- GPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Nov 30, 2001PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid parameters.CVE-2001-0937 · Other software · Matt Wright · reported by MITREHigh 7.5
PGPMail.pl 1.31 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) recipient or (2) pgpuserid parameters.
- Product
- Pgpmail.pl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Mar 12, 2001gpm 1.19.3 allows local users to overwrite arbitrary files via a symlink attack.CVE-2001-0116 · Other software · Immunix · reported by MITRELow 1.2
gpm 1.19.3 allows local users to overwrite arbitrary files via a symlink attack.
- Product
- Immunix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infolinux-mandrake.com
Jul 27, 2000Vulnerability in gpm in Caldera Linux allows local users to delete arbitrary files or conduct a denial of service.CVE-2000-0667 · Other software · Conectiva · reported by MITRELow 3.6
Vulnerability in gpm in Caldera Linux allows local users to delete arbitrary files or conduct a denial of service.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Mar 22, 2000gpm-root in the gpm package does not properly drop privileges, which allows local users to gain privileges by starting a utility from gpm-root.CVE-2000-0229 · Other software · Alessandro Rubini · reported by MITREHigh 7.2
gpm-root in the gpm package does not properly drop privileges, which allows local users to gain privileges by starting a utility from gpm-root.
- Product
- GPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comnovell.com
Nov 23, 1999Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets.CVE-2000-0531 · Other software · Caldera · reported by MITRELow 2.1
Linux gpm program allows local users to cause a denial of service by flooding the /dev/gpmctl device with STREAM sockets.
- Product
- Openlinux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comredhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.