Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4 results
Jan 15, 2026Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable recCVE-2026-22646 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can be used to map the application's internal structure and discover other, more critical vulnerabilities.
- Product
- Incoming Goods Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known secuCVE-2026-22645 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.
- Product
- Incoming Goods Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer hCVE-2026-22644 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.
- Product
- Incoming Goods Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g.CVE-2024-11075 · Other software · SICK AG · reported by psirt@sick.deHigh 8.8
A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.
- Product
- SICK Incoming Goods Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.