Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

347new WordPress flaws this week

390,007entries in the database

22 results

Sep 9, 2024**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 CVE-2024-6342 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com
Jun 3, 2024** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21CVE-2024-29976 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 6.5
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com zyxel.com
Jun 3, 2024** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZCVE-2024-29975 · Network & remote access · Zyxel · reported by security@zyxel.com.twMedium 6.7
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com zyxel.com
Jun 3, 2024** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZFCVE-2024-29974 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com zyxel.com
Jun 3, 2024** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NCVE-2024-29973 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com zyxel.com
Jun 3, 2024** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)CVE-2024-29972 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outpost24.com zyxel.com
Jan 29, 2024The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABCVE-2023-5372 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.2
The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Nov 29, 2023The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.CVE-2023-4474 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allCVE-2023-4473 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21CVE-2023-37928 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.8
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.CVE-2023-37927 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 8.8
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugprove.com zyxel.com
Nov 29, 2023A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versioCVE-2023-35138 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Nov 29, 2023An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABCVE-2023-35137 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.5
An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
May 29, 2023The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker wiCVE-2023-27988 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.2
The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.
Product
NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Sep 5, 2022A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution CVE-2022-34747 · Network & remote access · Zyxel · reported by security@zyxel.com.twCritical 9.8
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.
Product
Zyxel NAS326 firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Aug 6, 2020Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used forCVE-2020-13365 · Network & remote access · Zyxel · reported by MITREHigh 8.8
Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session as root. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Aug 6, 2020A backdoor in certain Zyxel products allows remote TELNET access via a CGI script.CVE-2020-13364 · Network & remote access · Zyxel · reported by MITREHigh 8.8
A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V5.11(AASZ.0)C0; NAS542 V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, and V5.21(ABAG.3)C0; NSA325 v2_V4.81(AALS.0)C0 and V4.81(AAAJ.1)C0; NSA310 4.22(AFK.0)C0 and 4.22(AFK.1)C0; NAS326 V5.21(AAZF.8)C0, V5.11(AAZF.4)C0, V5.11(AAZF.2)C0, and V5.11(AAZF.3)C0; NSA310S V4.75(AALH.2)C0; NSA320S V4.75(AANV.2)C0 and V4.75(AANV.1)C0; NSA221 V4.41(AFM.1)C0; and NAS540 V5.21(AATB.5)C0 and V5.21(AATB.3)C0.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zyxel.com zyxel.com
Apr 9, 2019An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, groCVE-2019-10634 · Network & remote access · Zyxel · reported by MITREMedium 5.4
An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maxwelldulin.com maxwelldulin.com
Apr 9, 2019An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute aCVE-2019-10633 · Network & remote access · Zyxel · reported by MITREHigh 8.8
An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maxwelldulin.com maxwelldulin.com
Apr 9, 2019A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the locatCVE-2019-10632 · Network & remote access · Zyxel · reported by MITREMedium 6.5
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maxwelldulin.com maxwelldulin.com
Apr 9, 2019Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via muCVE-2019-10631 · Network & remote access · Zyxel · reported by MITREHigh 8.8
Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maxwelldulin.com maxwelldulin.com
Apr 9, 2019A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.CVE-2019-10630 · Network & remote access · Zyxel · reported by MITREHigh 8.8
A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.
Product
Nas326 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record maxwelldulin.com maxwelldulin.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.