Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Sep 17, 2026Prebid Server Java is the Java version of Prebid Server.CVE-2026-54734 · Other software · prebid · reported by GitHubCritical 10
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.
- Product
- prebid-server-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Prebid Server is an open-source solution for running real-time advertising auctions in the cloud.CVE-2026-54735 · Other software · prebid · reported by GitHubCritical 10
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
- Product
- prebid-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026A broken access control may allow an authenticated user to perform a horizontal privilege escalation.CVE-2026-3999 · Other software · Pointsharp · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.8
A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations.
- Product
- ID Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modificCVE-2024-40579 · Other software · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modification of the hostname parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023SysAid Server Path Traversal VulnerabilityCVE-2023-47246 · Other software · SysAid · reported by MITREExploitedRansomwareCritical 9.8
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
- Product
- SysAid Server
- On CISA’s list since
- Nov 13, 2023 (federal fix deadline Dec 4, 2023)
- What to do
- Attackers are using this now. Install SysAid’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.sysaid.comdocumentation.sysaid.com
Oct 18, 2017The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managedCVE-2015-5164 · Other software · Pulpproject · reported by Red HatHigh 7.2
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
- Product
- Qpid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.compulp.plan.io
Nov 11, 2012The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.CVE-2012-4554 · Websites & servers · Drupal · reported by Red HatMedium 5
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
- Product
- Drupal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrupal.orgdrupalcode.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.