Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Jun 9, 2026A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low priviCVE-2026-6445 · Other software · Everpure · reported by psirt@purestorage.comHigh 8.7
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Jun 9, 2026A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyoCVE-2026-6444 · Other software · Everpure · reported by psirt@purestorage.comHigh 8.6
A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Apr 14, 2026Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.CVE-2026-0209 · Other software · PureStorage · reported by psirt@purestorage.comMedium 6.9
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
Sep 23, 2024A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP coCVE-2024-0005 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.1
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.CVE-2024-0004 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.1
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privilegedCVE-2024-0003 · Other software · PureStorage · reported by psirt@purestorage.comCritical 9.1
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.CVE-2024-0002 · Other software · PureStorage · reported by psirt@purestorage.comCritical 10
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor tCVE-2024-0001 · Other software · Pure Storage · reported by psirt@purestorage.comCritical 10
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
- Product
- FlashArray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024Purity Of Soul: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43348 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iznyn Purity Of Soul allows Reflected XSS.This issue affects Purity Of Soul: from n/a through 1.9.
- Product
- Purity Of Soul
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Purity Of Soul to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2023A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.CVE-2023-36628 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 8.8
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMCVE-2023-32572 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incluCVE-2023-28373 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 4.4
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.
- Product
- FlashArray Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot sCVE-2023-36627 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 7.7
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly.
- Product
- FlashBlade Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s dCVE-2023-31042 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 7.7
A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols.
- Product
- FlashBlade Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 2, 2023A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the CVE-2023-28372 · Other software · Pure Storage · reported by psirt@purestorage.comMedium 6.5
A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.
- Product
- FlashBlade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Jun 23, 2022Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure CVE-2022-32554 · Other software · Purestorage · reported by MITRECritical 9.8
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
- Product
- Purity//fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Jun 23, 2022Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure CVE-2022-32553 · Other software · Purestorage · reported by MITREHigh 8.8
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
- Product
- Purity//fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Jun 23, 2022Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure CVE-2022-32552 · Other software · Purestorage · reported by MITREHigh 8.8
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
- Product
- Purity//fa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.comsupport.purestorage.com
Oct 11, 2017Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "hCVE-2017-7352 · Other software · Purestorage · reported by MITREMedium 5.4
Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System > Configuration > SNMP > Add SNMP Trap Manager' screen.
- Product
- Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarthrocyber.comarthrocyber.com
Oct 20, 2014Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTMLCVE-2012-2413 · Websites & servers · Joomla · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jun 5, 2009Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTCVE-2009-1939 · Websites & servers · Joomla · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgosvdb.org
Sep 24, 2002Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.CVE-2002-1124 · Other software · Purity · reported by MITREHigh 7.2
Multiple buffer overflows in purity 1-16 allow local users to gain privileges and modify high scores tables.
- Product
- Purity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.