Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Sep 23, 2026A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1.CVE-2026-96882 · Other software · TaleLin · reported by VulDBMedium 5.5
A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1.CVE-2026-96881 · Other software · TaleLin · reported by VulDBMedium 5.5
A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1.CVE-2026-96880 · Other software · TaleLin · reported by VulDBMedium 5.5
A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2026A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1.CVE-2026-10152 · Other software · TaleLin · reported by VulDBLow 2.1
A vulnerability was detected in TaleLin lin-cms-spring-boot up to 0.2.1. This issue affects some unknown processing of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0.CVE-2025-15151 · Other software · TaleLin · reported by VulDBLow 2.9
A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This manipulation of the argument username/password causes password in configuration file. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- Lin-CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3.CVE-2025-15129 · Other software · ChenJinchuang · reported by VulDBLow 2.1
A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. This vulnerability affects the function Upload of the file application/lib/file/LocalUploader.php of the component File Upload Handler. Executing manipulation of the argument File can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Lin-CMS-TP5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in theCVE-2024-41600 · Other software · Talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- Lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2024Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserControCVE-2024-41601 · Other software · talelin · reported by MITREHigh 7.5
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- Product
- lin-cms-java-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.CVE-2022-44244 · Other software · Lin-cms Project · reported by MITREMedium 6.6
An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
- Product
- Lin-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 21, 2022An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.CVE-2022-32430 · Other software · Talelin · reported by MITREHigh 7.5
An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.
- Product
- Lin-cms-spring-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2021Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalCVE-2020-18701 · Other software · Talelin · reported by MITRECritical 9.8
Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets.
- Product
- Lin-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 16, 2021Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the CVE-2020-18699 · Other software · Talelin · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'.
- Product
- Lin-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2021Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in theCVE-2020-18698 · Other software · Talelin · reported by MITRECritical 9.8
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'.
- Product
- Lin-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.