Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Oct 2, 2026Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaCVE-2026-82458 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- Product
- Apache Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 10, 2026The cstruct package before 6.3.0 for OCaml mishandles indexes.CVE-2026-89087 · Other software · OCaml · reported by MITREHigh 7.3
The cstruct package before 6.3.0 for OCaml mishandles indexes.
- Product
- cstruct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the CVE-2026-89086 · Other software · OCaml · reported by MITRECritical 9.1
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.
- Product
- jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml.CVE-2026-87737 · Other software · OCaml · reported by MITREMedium 5.9
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret.
- Product
- mirage-crypto-ec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml.CVE-2026-87736 · Other software · OCaml · reported by MITREMedium 4.3
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.
- Product
- mirage-crypto-ec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml.CVE-2026-87735 · Other software · OCaml · reported by MITREMedium 4.3
An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption.
- Product
- mirage-crypto-pk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the utcp package before 0.0.6 for OCaml.CVE-2026-87734 · Other software · OCaml · reported by MITREHigh 7.5
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
- Product
- utcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml.CVE-2026-87733 · Other software · OCaml · reported by MITREMedium 6.2
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.
- Product
- mirage-crypto-ec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml.CVE-2026-87732 · Other software · OCaml · reported by MITREMedium 6.2
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext.
- Product
- mirage-crypto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.CVE-2026-57825 · Other software · OCaml · reported by MITREMedium 5.7
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Product
- opam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026The cohttp package before 6.3.0 for OCaml allows directory traversal.CVE-2026-82481 · Other software · mirage · reported by MITREHigh 8.7
The cohttp package before 6.3.0 for OCaml allows directory traversal.
- Product
- cohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory.CVE-2026-45390 · Other software · reported by MITRECritical 9.1
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), whicCVE-2026-45389 · Other software · reported by MITREHigh 7.4
In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificates that are not meant for client authentication (because of KeyUsage and ExtendedKeyUsage).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certifiCVE-2026-45388 · Other software · reported by MITRECritical 9.1
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.CVE-2026-41082 · Other software · OCaml · reported by MITREHigh 7.3
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
- Product
- opam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.CVE-2026-34353 · Other software · OCaml · reported by MITREMedium 5.9
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Product
- OCaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phasCVE-2026-28364 · Other software · OCaml · reported by MITREHigh 7.9
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
- Product
- OCaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures.CVE-2023-23928 · Other software · ulrikstrid · reported by GitHubMedium 5.9
reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.
- Product
- reason-jose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision.CVE-2022-42324 · Other software · Xen · reported by security@xen.orgMedium 5.5
Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Apr 6, 2018The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled datCVE-2018-9838 · Other software · Ocaml · reported by MITRECritical 9.8
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.
- Product
- Ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaml.inria.frsecurity.gentoo.org
Dec 14, 2017batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER enviroCVE-2017-17519 · Other software · Ocaml Batteries Project · reported by MITREHigh 8.8
batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Product
- Ocaml Batteries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurity-tracker.debian.org
Sep 7, 2017OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."CVE-2017-9779 · Other software · Ocaml · reported by MITREHigh 7.8
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."
- Product
- Ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaml.inria.frsympa.inria.fr
Jun 23, 2017Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuiCVE-2017-9772 · Other software · Ocaml · reported by MITRECritical 9.8
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
- Product
- Ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcaml.inria.fr
Jun 13, 2016OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information aCVE-2015-8869 · Other software · Fedoraproject · reported by MITRECritical 9.1
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
- Product
- Fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.opensuse.org
Nov 2, 2013The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a lCVE-2013-4416 · Other software · XEN · reported by Red HatMedium 5.2
The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.
- Product
- XEN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 17, 2013The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users CVE-2013-4370 · Other software · XEN · reported by Red HatMedium 4.6
The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.
- Product
- XEN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurity.gentoo.org
Aug 25, 2012OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent CVE-2012-3514 · Other software · Nicolas Cannasse · reported by Red HatMedium 5
OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via unspecified vectors.
- Product
- Ocaml Xml-light Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commandriva.com
Feb 8, 2012OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers tCVE-2012-0839 · Other software · Inria · reported by Red HatMedium 5
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
- Product
- Ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 22, 2009The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote atCVE-2009-2943 · Other software · Ocaml · reported by MITREHigh 7.5
The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
- Product
- Postgresql-ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2009The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers to leverage escaping CVE-2009-2942 · Other software · Mysql-ocaml · reported by MITREHigh 7.5
The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
- Product
- Mysql-ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.