Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
May 14, 2026Open OnDemand is an open-source high-performance computing portal.CVE-2026-44371 · Other software · OSC · reported by GitHubMedium 5.3
Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026Open OnDemand is an open-source high-performance computing portal.CVE-2026-26002 · Other software · OSC · reported by GitHubMedium 6.3
Open OnDemand is an open-source high-performance computing portal. The Files application in OnDemand versions prior to 4.0.9 and 4.1.3 is susceptible to malicious input when navigating to a directory. This has been patched in versions 4.0.9 and 4.1.3. Versions below this remain susceptible.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Open OnDemand provides remote web access to supercomputers.CVE-2025-66029 · Other software · OSC · reported by GitHubHigh 7.6
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Open OnDemand is an open-source HPC portal.CVE-2025-64185 · Other software · OSC · reported by GitHubMedium 6.9
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Open OnDemand is an open-source HPC portal.CVE-2025-62724 · Other software · OSC · reported by GitHubMedium 4.3
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Open OnDemand is an open-source HPC portal.CVE-2025-58435 · Other software · OSC · reported by GitHubMedium 4.1
Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop session and the other user would need to be authenticated to the portal. But obtaining the link would allow that user to perform any actions as the original user and access their data. Open OnDemand 3.1.15 and 4.0.7 have patched this vulnerability and correctly rotate passwords for any version of TurboVNC. As a workaround, downgrade TurboVNC to a version lower than 3.1.2.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025Open OnDemand is an open-source HPC portal.CVE-2025-53636 · Other software · OSC · reported by GitHubMedium 5.4
Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6.
- Product
- ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2022The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted inputCVE-2020-27958 · Other software · OSU · reported by MITREMedium 4.3
The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template.
- Product
- Ohio Supercomputer Center Open Ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.osc.edugithub.com
Feb 19, 2021Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.CVE-2020-36247 · Other software · OSC · reported by MITREHigh 8.8
Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.
- Product
- Open Ondemand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlistsprd.osu.edulistsprd.osu.edu
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.