Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Sep 11, 2026GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityCVE-2026-85706 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.
- Product
- Community Edition and Enterprise Edition
- On CISA’s list since
- Sep 11, 2026 (federal fix deadline Sep 14, 2026)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comhackerone.com
Aug 25, 2026Gitea Code Injection VulnerabilityCVE-2026-60004 · Other software · Gitea · reported by MITREExploitedCritical 9.8
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
- Product
- Gitea
- On CISA’s list since
- Aug 25, 2026 (federal fix deadline Aug 28, 2026)
- What to do
- Attackers are using this now. Install Gitea’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.gitea.comgithub.com
Feb 18, 2026GitLab Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-22175 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedMedium 6.8
GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
- Product
- GitLab
- On CISA’s list since
- Feb 18, 2026 (federal fix deadline Mar 11, 2026)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comgitlab.com
Feb 3, 2026GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-39935 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedMedium 6.8
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.
- Product
- Community and Enterprise Editions
- On CISA’s list since
- Feb 3, 2026 (federal fix deadline Feb 24, 2026)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comgitlab.com
Aug 25, 2025Git Link Following VulnerabilityCVE-2025-48384 · Other software · Git · reported by GitHubExploitedHigh 8
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
- Product
- Git
- On CISA’s list since
- Aug 25, 2025 (federal fix deadline Sep 15, 2025)
- What to do
- Attackers are using this now. Install Git’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comseclists.org
Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
- Product
- action-setup GitHub Action
- On CISA’s list since
- Mar 24, 2025 (federal fix deadline Apr 14, 2025)
- What to do
- Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Mar 18, 2025tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30066 · Other software · tj-actions · reported by MITREExploitedHigh 8.6
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
- Product
- changed-files GitHub Action
- On CISA’s list since
- Mar 18, 2025 (federal fix deadline Apr 8, 2025)
- What to do
- Attackers are using this now. Install tj-actions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.gitguardian.comgithub.com
May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedCritical 10
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
- Product
- GitLab CE/EE
- On CISA’s list since
- May 1, 2024 (federal fix deadline May 22, 2024)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggitlab.comhackerone.com
Nov 3, 2021GitLab Community and Enterprise Editions Remote Code Execution VulnerabilityCVE-2021-22205 · Websites & servers · GitLab · reported by cve@gitlab.comExploitedRansomwareCritical 10
GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.
- Product
- Community and Enterprise Editions
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install GitLab’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.