Vulnerability database

4 results

• Apr 2, 2026TrueConf Client Download of Code Without Integrity Check VulnerabilityCVE-2026-3502 · Other software · TrueConf · reported by cve@checkpoint.comExploitedHigh 7.8

  TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

  Product

  Client

  On CISA’s list since

  Apr 2, 2026 (federal fix deadline Apr 16, 2026)

  What to do

  Attackers are using this now. Install TrueConf’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogtrueconf.comresearch.checkpoint.com

• Feb 12, 2026Notepad++ Download of Code Without Integrity Check VulnerabilityCVE-2025-15556 · Other software · Notepad++ · reported by VulnCheckExploitedHigh 7.7

  Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirect update traffic to download and execute an attacker-controlled installer. This could lead to arbitrary code execution with the privileges of the user.

  Product

  Notepad++

  On CISA’s list since

  Feb 12, 2026 (federal fix deadline Mar 5, 2026)

  What to do

  Attackers are using this now. Install Notepad++’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcommunity.notepad-plus-plus.orggithub.com

• Aug 5, 2025D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityCVE-2022-40799 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8

  D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  Product

  DNR-322L

  On CISA’s list since

  Aug 5, 2025 (federal fix deadline Aug 26, 2025)

  What to do

  Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggitlab.comgitlab.com

• Mar 3, 2022Oracle Java SE Integrity Check VulnerabilityCVE-2015-4902 · Other software · Oracle · reported by secalert_us@oracle.comExploitedMedium 5.3

  Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.

  Product

  Java SE

  On CISA’s list since

  Mar 3, 2022 (federal fix deadline Mar 24, 2022)

  What to do

  Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.opensuse.orglists.opensuse.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.