Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Sep 22, 2026A security flaw has been discovered in recommenders-team recommenders up to 1.2.1.CVE-2026-95928 · Other software · recommenders-team · reported by VulDBLow 2
A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- recommenders
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49009 · Other software · reported by MITRELow 3.1
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
May 27, 2026Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.CVE-2026-33552 · Other software · reported by MITRELow 3.7
Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnorthern.techmender.io
May 27, 2026Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.CVE-2025-67903 · Other software · reported by MITREMedium 5.3
Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Jun 26, 2025Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control.CVE-2025-49603 · Other software · reported by MITRECritical 9.1
Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Jan 21, 2025Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.CVE-2024-55959 · Other software · reported by MITRECritical 9.1
Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnorthern.techmender.io
Nov 8, 2024Northern.tech Hosted Mender before 2024.07.11 allows SSRF.CVE-2024-47190 · Other software · reported by MITRELow 2.7
Northern.tech Hosted Mender before 2024.07.11 allows SSRF.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.CVE-2024-46948 · Other software · Northern.tech · reported by MITREMedium 4.3
Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.
- Product
- Mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.CVE-2024-46947 · Other software · northern.tech · reported by MITREMedium 6.5
Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.
- Product
- mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and coulCVE-2022-45929 · Other software · northern.tech · reported by MITREHigh 8.8
Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user.
- Product
- mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Jun 20, 2024Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitivCVE-2022-41324 · Other software · reported by MITREMedium 6.5
Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Jun 3, 2024Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.CVE-2024-37019 · Other software · northern.tech · reported by MITRECritical 9.8
Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.
- Product
- mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Jul 6, 2022The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control.CVE-2022-32290 · Other software · Northern.tech · reported by MITREMedium 4.3
The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server.
- Product
- Mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Apr 28, 2022The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primiCVE-2022-29556 · Other software · Northern.tech · reported by MITRECritical 9.8
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.
- Product
- Mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Apr 28, 2022The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2.CVE-2022-29555 · Other software · Northern.tech · reported by MITREHigh 8.8
The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking.
- Product
- Mender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Aug 27, 2021The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows useCVE-2021-35342 · Other software · Northern.tech · reported by MITREHigh 7.5
The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).
- Product
- Useradm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmender.ionorthern.tech
Aug 9, 2019Recommender before 2018-07-18 allows XSS.CVE-2018-20858 · Other software · EDX · reported by MITREMedium 6.1
Recommender before 2018-07-18 allows XSS.
- Product
- Recommender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.