Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by suCVE-2026-110624 · Other software · papermerge · reported by VulnCheckLow 2.3
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documCVE-2026-110623 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page managCVE-2026-110622 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call.CVE-2026-105314 · Other software · Papermerge · reported by MITREHigh 7.5
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
- Product
- Papermerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A security flaw has been discovered in Papermerge DMS up to 3.5.3.CVE-2025-10209 · Other software · Papermerge · reported by VulDBLow 2.1
A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Dec 2, 2020Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tagCVE-2020-29456 · Other software · Papermerge · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
- Product
- Papermerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.