Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 24, 2025Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project.CVE-2025-62714 · Other software · karmada-io · reported by GitHubHigh 8.7
Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data.
- Product
- dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-56514 · Other software · karmada-io · reported by GitHubMedium 5.3
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by Karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a Karmada initialization could write arbitrary files in arbitrary paths of the filesystem. From Karmada version 1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness. A workaround is available. Someone who needs to set flag `--crd` to customize the CRD files required for Karmada initialization when using `karmadactl init` to set up Karmada can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files. When using karmada-operator to set up Karmada, one must upgrade one's karmada-operator to one of the fixed versions.
- Product
- karmada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2025Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-56513 · Other software · karmada-io · reported by GitHubHigh 8.7
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters. Since Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada. As a workaround, one may restrict the access permissions of pull mode member clusters to control plane resources according to Karmada Component Permissions Docs.
- Product
- karmada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karmaCVE-2024-42618 · Other software · pligg · reported by MITREHigh 8.8
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma
- Product
- pligg_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024WOWS Karma is a reputation system for Wargaming's World of Warships.CVE-2024-34695 · Other software · SakuraIsayeki · reported by GitHubMedium 6.3
WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
- Product
- WOWS-Karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.CVE-2024-33396 · Other software · karmada-io · reported by MITREHigh 8.4
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
- Product
- karmada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 18, 2022Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agCVE-2022-24038 · Other software · Karmasis Informatics · reported by iletisim@usom.gov.trMedium 6.5
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.
- Product
- Infraskope SIEM+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmasis.comsiberguvenlik.gov.tr
Nov 18, 2022Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical informationCVE-2022-24037 · Other software · Karmasis Informatics · reported by iletisim@usom.gov.trHigh 8.2
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.
- Product
- Infraskope SIEM+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmasis.comsiberguvenlik.gov.tr
Nov 16, 2022Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.CVE-2022-24036 · Other software · Karmasis Informatics · reported by iletisim@usom.gov.trHigh 8.6
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.
- Product
- Infraskope SIEM+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmasis.comsiberguvenlik.gov.tr
Oct 14, 2022Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.CVE-2022-37602 · Other software · Grunt-karma Project · reported by MITRECritical 9.8
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
- Product
- Grunt-karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.CVE-2021-23495 · Other software · Karma Project · reported by report@snyk.ioMedium 5.4
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
- Product
- Karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.CVE-2022-0437 · Other software · karma-runner · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
- Product
- karma-runner/karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2020karma-mojo through 1.0.1 is vulnerable to Command Injection.CVE-2020-7626 · Other software · Karma-mojo Project · reported by report@snyk.ioCritical 9.8
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
- Product
- Karma-mojo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2019Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.CVE-2011-4090 · Other software · serendipity · reported by Red HatMedium 6.1
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
- Product
- serendipity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comseclists.org
Dec 20, 2018SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitraCVE-2018-18399 · Other software · JCO · reported by MITRECritical 9.8
SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
- Product
- Karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Feb 25, 2009Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticateCVE-2008-6276 · Websites & servers · Drupal · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via (1) a content type or (2) a voting API value.
- Product
- User Karma Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2009Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackersCVE-2008-6275 · Websites & servers · Drupal · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages.
- Product
- User Karma Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2008SQL injection vulnerability in comment.php in Fizzmedia 1.51.2 allows remote attackers to execute arbitrary SQL commands via the mid parameter.CVE-2008-3378 · Other software · Fizzmedia Negativekarma · reported by MITREHigh 7.5
SQL injection vulnerability in comment.php in Fizzmedia 1.51.2 allows remote attackers to execute arbitrary SQL commands via the mid parameter.
- Product
- Fizzmedia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.