Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
43 results
May 5, 2025NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps funCVE-2024-57231 · Network & remote access · Netgear · reported by MITRECritical 9.8
NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
- Product
- Rax50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check The devm_kzalloc() function doesn't CVE-2024-58066 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check The devm_kzalloc() function doesn't return error pointers, it returns NULL on error. Update the check to match.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check The devm_kzalloc() function returns NULCVE-2024-58065 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check The devm_kzalloc() function returns NULL on error, not error pointers. Fix the check.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 10, 2025Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.CVE-2024-57227 · Network & remote access · Linksys · reported by MITREHigh 8
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
- Product
- E7350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.CVE-2024-41317 · Other software · totolink · reported by MITREHigh 8
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
- Product
- a6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 28, 2023In startWpsPbcInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validation.CVE-2023-21203 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In startWpsPbcInternal of sta_iface.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262246082
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 22, 2023The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] paraCVE-2023-28659 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 11, 2022Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user to potentially enabCVE-2022-32569 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC M15 Laptop KIT Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022An issue has been found in PBC through 2022-8-27.CVE-2022-38936 · Other software · PBC Project · reported by MITREHigh 7.5
An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalatioCVE-2022-34488 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation oCVE-2022-34345 · Other software · Intel · reported by secure@intel.comMedium 6.2
Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation oCVE-2022-33209 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of CVE-2022-32579 · Other software · Intel · reported by secure@intel.comHigh 7.2
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via physical access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalationCVE-2022-28858 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation CVE-2022-27493 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.CVE-2022-24382 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.CVE-2022-24297 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Improper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.CVE-2022-21237 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local access.CVE-2021-33086 · Other software · Intel · reported by secure@intel.comMedium 5.5
Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local access.
- Product
- NUC M15 Laptop KIT Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021 Improper access control in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local acceCVE-2021-0067 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC M15 Laptop KIT Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially CVE-2021-0058 · Other software · Intel · reported by secure@intel.comHigh 7.8
Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enablCVE-2021-0057 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentiallCVE-2021-0056 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insecure inherited permissions for the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper buffer restrictions in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local accesCVE-2021-0054 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper buffer restrictions in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- NUC M15 Laptop KIT Lapbc510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14744 · Other software · PBC Project · reported by MITRECritical 9.8
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A use-after-free can occur in _pbcM_sp_query in map.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14743 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in wiretype_decode in context.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14742 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c during a memcpy.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14741 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_pack in pattern.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14740 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c while making a query.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14739 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_set_default in pattern.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14738 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_rmessage_message in rmessage.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14737 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A NULL pointer dereference can occur in pbc_wmessage_string in wmessage.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2018An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02.CVE-2018-14736 · Other software · PBC Project · reported by MITREHigh 7.5
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A buffer over-read can occur in pbc_wmessage_string in wmessage.c for PTYPE_ENUM.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.CVE-2018-12918 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.CVE-2018-12917 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.CVE-2018-12916 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.CVE-2018-12915 · Other software · PBC Project · reported by MITRECritical 9.8
In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c.
- Product
- PBC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2017Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.3CVE-2017-16678 · Network & remote access · SAP · reported by cna@sap.comMedium 4.7
Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.
- Product
- SAP NetWeaver Knowledge Management Configuration Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Aug 31, 2010The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute aCVE-2010-3189 · Other software · Trendmicro · reported by MITREHigh 9.3
The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.
- Product
- Internet Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesupport.trendmicro.comsecunia.com
May 14, 2008Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitCVE-2008-2216 · Other software · Pbcs · reported by MITREHigh 9
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.
- Product
- Project-based Calendaring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
May 14, 2008Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a ..CVE-2008-2215 · Other software · Pbcs · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) src/yopy_sync.php and (2) system-logger/print_logs.php.
- Product
- Project-based Calendaring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Apr 13, 2006Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) allows remote attackers to read arbitrary fCVE-2006-1771 · Other software · Saxotech · reported by MITREHigh 7.5
Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) allows remote attackers to read arbitrary files and possibly execute arbitrary programs via a .. (dot dot) in the url parameter.
- Product
- Saxopress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Oct 4, 2002Cross-site scripting vulnerability in PowerBASIC pbcgi.cgi, as included in Lil' HTTP web server, allows remote attackers to execute arbitrary web script in otheCVE-2002-1009 · Websites & servers · Summit Computer Networks · reported by MITREHigh 7.5
Cross-site scripting vulnerability in PowerBASIC pbcgi.cgi, as included in Lil' HTTP web server, allows remote attackers to execute arbitrary web script in other web browsers via the (1) "Name" or (2) "E-mail" parameters.
- Product
- LIL Http Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.