Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Oct 14, 2026Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outsideCVE-2026-110717 · Other software · meetecho · reported by VulnCheckMedium 6.9
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
- Product
- janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2.CVE-2026-108831 · Other software · meetecho · reported by VulDBLow 2.1
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
- Product
- janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A weakness has been identified in meetecho janus-gateway up to 1.4.2.CVE-2026-108830 · Other software · meetecho · reported by VulDBLow 1.3
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions.CVE-2022-36228 · Other software · Janusintl · reported by MITREMedium 6.5
Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.
- Product
- Noke Standard Smart Padlock Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 16, 2021janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4124 · Other software · meetecho · reported by security@huntr.devMedium 6.1
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- meetecho/janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2021janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4020 · Other software · meetecho · reported by security@huntr.devMedium 5.4
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- meetecho/janus-gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-14034 · Other software · Meetecho · reported by MITRECritical 9.8
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_get_codec_from_pt in utils.c has a Buffer Overflow via long value in an SDP Offer packet.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-14033 · Other software · Meetecho · reported by MITRECritical 9.8
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_streaming_rtsp_parse_sdp in plugins/janus_streaming.c has a Buffer Overflow via a crafted RTSP server.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-13901 · Other software · Meetecho · reported by MITRECritical 9.8
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-13900 · Other software · Meetecho · reported by MITREHigh 7.5
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-13899 · Other software · Meetecho · reported by MITREHigh 7.5
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in janus.c discloses information from uninitialized stack memory.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.CVE-2020-13898 · Other software · Meetecho · reported by MITREHigh 7.5
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NULL pointer dereference.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2020An issue was discovered in Janus through 0.9.1.CVE-2020-10577 · Other software · Meetecho · reported by MITREMedium 4.8
An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when claiming sessions.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2020An issue was discovered in Janus through 0.9.1.CVE-2020-10576 · Other software · Meetecho · reported by MITREMedium 5.9
An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2020An issue was discovered in Janus through 0.9.1.CVE-2020-10575 · Other software · Meetecho · reported by MITREMedium 4.2
An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2020An issue was discovered in Janus through 0.9.1.CVE-2020-10574 · Other software · Meetecho · reported by MITRECritical 9.8
An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in the JSON validation.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2020An issue was discovered in Janus through 0.9.1.CVE-2020-10573 · Other software · Meetecho · reported by MITREHigh 7.5
An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge.
- Product
- Janus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.