Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Nov 30, 2025HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job.CVE-2025-66433 · Other software · wisc · reported by MITREMedium 4.2
HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24.12.14, 25.0.3, and 25.3.1. The earliest affected version is 24.7.3.
- Product
- HTCondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization rCVE-2025-30093 · Other software · Wisc · reported by MITREHigh 8.1
HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0.CVE-2022-26110 · Other software · Wisc · reported by MITREHigh 8.8
An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgresearch.cs.wisc.edu
Apr 5, 2022An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1.CVE-2021-45104 · Other software · Wisc · reported by MITREHigh 7.4
An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker who can capture HTCondor network data can interfere with users' jobs and data.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Apr 5, 2022An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1.CVE-2021-45103 · Other software · Wisc · reported by MITREHigh 8.1
An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked HTCondor to transfer.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Dec 16, 2021An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2.CVE-2021-45102 · Other software · Wisc · reported by MITREHigh 8.8
An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon using a SciToken, a user may be granted authorizations beyond what the token should allow.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Dec 16, 2021An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2.CVE-2021-45101 · Other software · Wisc · reported by MITREHigh 8.1
An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. Using standard command-line tools, a user with only READ access to an HTCondor SchedD or Collector daemon can discover secrets that could allow them to control other users' jobs and/or read their data.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Jan 27, 2021HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.CVE-2021-25312 · Other software · Wisc · reported by MITREHigh 8.8
HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Jan 27, 2021condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file underCVE-2021-25311 · Other software · Wisc · reported by MITRECritical 9.9
condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by creating a file under /etc that will later be executed by root.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduresearch.cs.wisc.edu
Apr 27, 2020HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control.CVE-2019-18823 · Other software · Wisc · reported by MITRECritical 9.8
HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jan 31, 2020The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.CVE-2014-8126 · Other software · HTCondor · reported by Red HatHigh 8.8
The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
- Product
- HTCondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Jul 5, 2018The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by levCVE-2017-16816 · Other software · Wisc · reported by MITREMedium 6.5
The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.
- Product
- Htcondor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.cs.wisc.eduwww-auth.cs.wisc.edu
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.