Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
129 results · page 1 of 3
Oct 15, 2026Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central CVE-2026-111142 · Other software · gdraheim · reported by VulnCheckMedium 6.8
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mappeCVE-2026-111141 · Other software · gdraheim · reported by VulnCheckMedium 5.7
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026cpp-httplib is a C++ header-only HTTP/HTTPS library.CVE-2026-103930 · Other software · yhirose · reported by GitHubLow 3.7
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026cpp-httplib is a C++ header-only HTTP/HTTPS library.CVE-2026-102944 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in anotCVE-2026-76154 · Other software · Grafana · reported by security@grafana.comHigh 7.3
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TOCVE-2026-90467 · Other software · cole · reported by VulnCheckMedium 6.3
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
- Product
- aiosmtplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026MapLibre GL JS is an interactive vector tile map library for web browsers.CVE-2026-85061 · Other software · maplibre · reported by GitHubCritical 10
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
- Product
- maplibre-gl-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026cpp-httplib is a C++ header-only HTTP/HTTPS library.CVE-2026-77358 · Other software · yhirose · reported by GitHubHigh 8.2
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket connection triggers the defect. This issue is fixed in version 0.50.1.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026cpp-httplib is a C++ header-only HTTP/HTTPS library.CVE-2026-77341 · Other software · yhirose · reported by GitHubMedium 5.3
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, letting an attacker forge response headers or inject a second response. This issue is fixed in version 0.50.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026aiosmtplib is an asynchronous SMTP client for use with asyncio.CVE-2026-55558 · Other software · cole · reported by GitHubMedium 5.9
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
- Product
- aiosmtplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026aiosmtplib is an asynchronous SMTP client for use with asyncio.CVE-2026-53533 · Other software · cole · reported by GitHubMedium 6.9
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker who influences an envelope sender or recipient to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server. This issue is fixed in version 5.1.1.
- Product
- aiosmtplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success evCVE-2026-72496 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.2
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Proper rollback if the ioremap fails bnxt_qplib_alloc_dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 10, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-54919 · Other software · yhirose · reported by GitHubHigh 7.4
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Client in HTTPS mode skip certificate chain validation and WebSocketClient on the Mbed TLS backend skips verification altogether, allowing a man-in-the-middle attacker positioned to intercept traffic to present a crafted certificate and read or modify the traffic. This issue is fixed in version 0.47.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026httplib2 is a comprehensive HTTP client library for Python.CVE-2026-59939 · Other software · httplib2 · reported by GitHubHigh 7.5
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
- Product
- httplib2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was CVE-2026-49486 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
- Product
- Apache Airflow FTP provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Jun 23, 2026picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) eCVE-2026-56315 · Other software · picklescan · reported by VulnCheckCritical 9.3
picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.
- Product
- picklescan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 29, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-46527 · Other software · yhirose · reported by GitHubHigh 8.7
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-45372 · Other software · yhirose · reported by GitHubCritical 9.9
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-45352 · Other software · yhirose · reported by GitHubMedium 5.3
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed.CVE-2026-8328 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLCVE-2026-41016 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
- Product
- Apache Airflow Providers SMTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 31, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-34441 · Other software · yhirose · reported by GitHubMedium 4.8
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.40.0, cpp-httplib is vulnerable to HTTP Request Smuggling. The server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connections, the unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request. An attacker can embed an arbitrary HTTP request inside the body of a GET request, which the server processes as a separate request. This issue has been patched in version 0.40.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-33745 · Other software · yhirose · reported by GitHubHigh 7.4
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following cross-origin HTTP redirects (301/302/307/308). A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the `Authorization` header. Version 0.39.0 fixes the issue.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-32627 · Other software · yhirose · reported by GitHubHigh 8.7
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-31870 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-29076 · Other software · yhirose · reported by GitHubMedium 5.9
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-28435 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-28434 · Other software · yhirose · reported by GitHubMedium 5.3
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.CVE-2025-15367 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.CVE-2025-15366 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.9
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-22776 · Other software · yhirose · reported by GitHubHigh 8.7
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2026cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2026-21428 · Other software · yhirose · reported by GitHubHigh 7.7
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2025Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated: Server-Side Request ForgeryCVE-2025-11970 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 5, 2025cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2025-66577 · Other software · yhirose · reported by GitHubMedium 5.3
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2025-66570 · Other software · yhirose · reported by GitHubCritical 10
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, en
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2025-53629 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is related to CVE-2025-53628.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2025-53628 · Other software · yhirose · reported by GitHubMedium 6.3
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.CVE-2025-52887 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.CVE-2025-46728 · Other software · yhirose · reported by GitHubHigh 7.5
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte.CVE-2025-0825 · Other software · Yhirose · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647Medium 6.9
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
- Product
- Cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netgithub.com
Nov 7, 2024In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_dCVE-2024-50172 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix a possible memory leak In bnxt_re_setup_chip_ctx() when bnxt_qplib_map_db_bar() fails driver is not freeing the memory allocated for "rdev->chip_ctx".
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 27, 2024A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/ziCVE-2024-39134 · Other software · zziplib · reported by MITREHigh 7.5
A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zipCVE-2024-39133 · Other software · zziplib_project · reported by MITREMedium 4.3
Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior isCVE-2024-38540 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 4.4
In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_stride == 0. In that case, "roundup_pow_of_two(hwq_attr->aux_stride)" gets called. roundup_pow_of_two is documented as undefined for 0. Fix it in the one caller that had this combination. The undefined behavior was detected by UBSAN: UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 24 PID: 1075 Comm: (udev-worker) Not tainted 6.9.0-rc6+ #4 Hardware name: Abacus electric, s.r.o. - servis@abacus.cz Super Server/H12SSW-iN, BIOS 2.7 10/25/2023 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x30 __ubsan_handle_shift_out_of_bounds.cold+0x61/0xec __roundup_pow_of_two+0x25/0x35 [bnxt_re] bnxt_qplib_alloc_init_hwq+0xa1/0x470 [bnxt_re] bnxt_qplib_create_qp+0x19e/0x840 [bnxt_re] bnxt_re_create_qp+0x9b1/0xcd0 [bnxt_re] ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 30, 2024asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DCP_TimedText.cpp in lCVE-2024-37017 · Other software · debian · reported by MITREHigh 8.1
asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DCP_TimedText.cpp in libasdcp.so.
- Product
- as_dcp_lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2023An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.CVE-2020-18770 · Other software · Gdraheim · reported by MITREMedium 5.5
An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.
- Product
- Zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in tCVE-2023-26130 · Other software · yhirose · reported by report@snyk.ioHigh 7.5
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).
- Product
- cpp-httplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 4, 2022diplib v3.0.0 is vulnerable to Double Free.CVE-2021-39432 · Other software · Diplib · reported by MITREMedium 6.5
diplib v3.0.0 is vulnerable to Double Free.
- Product
- Diplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php.CVE-2021-40642 · Other software · Textpattern · reported by MITREMedium 4.3
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificatCVE-2022-32151 · Other software · Splunk, Inc · reported by prodsec@splunk.comHigh 7.4
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.splunk.comdocs.splunk.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.