Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Oct 13, 2026reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scCVE-2026-104584 · Other software · reported by MITRECritical 9.8
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was found in yogeshojha reNgine up to 2.2.0.CVE-2026-105487 · Other software · yogeshojha · reported by VulDBLow 2.1
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
- Product
- reNgine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recoCVE-2026-92570 · Other software · yogeshojha · reported by VulnCheckHigh 7.1
reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteCVE-2026-58127 · Other software · Hyland · reported by VulnCheckCritical 9.3
PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the host filesystem. The ObjectURIs are identical across all installations by default. Chaining the arbitrary file write primitive with DLL hijacking opportunities in the MediaWriter service (which runs as NT Authority\\SYSTEM and loads missing DLLs such as CRYPTBASE.DLL from the application directory) enables unauthenticated remote code execution as SYSTEM upon service restart.
- Product
- PACSgear MediaWriter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comhyland.com
Jun 1, 2026In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code.CVE-2025-22426 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgresCVE-2026-29090 · Other software · rucio · reported by GitHubCritical 9
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
- Product
- rucio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database thCVE-2026-29080 · Other software · rucio · reported by GitHubCritical 9.4
A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents. Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend
- Product
- rucio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerOnly function.CVE-2026-31065 · Other software · UTT · reported by MITREMedium 4.5
UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formConfigCliForEngineerOnly function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- 520w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure.CVE-2025-48630 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules).CVE-2026-24798 · Other software · GaijinEntertainment · reported by cve_disclosure@tech.gov.sgCritical 9.3
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability is associated with program files upnpreplyparse.C. This issue affects DagorEngine: through dagor_2025_01_15.
- Product
- DagorEngine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute aCVE-2024-58287 · Other software · rengine · reported by VulnCheckHigh 8.7
reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan engine configuration.
- Product
- reNgine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrengine.wiki
Oct 10, 2025ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.CVE-2025-61319 · Other software · Yogeshojha · reported by MITREMedium 6.1
ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. When scanning a target with an XSS payload, the unsanitized payload is rendered in the ReNgine web UI, resulting in arbitrary JavaScript execution in the victim's browser. This can be abused to steal session cookies, perform unauthorized actions, or compromise the ReNgine administrator's account.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File UploCVE-2025-34100 · Other software · BuilderEngine · reported by VulnCheckCritical 9.3
An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsupport.alertlogic.com
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24968 · Other software · yogeshojha · reported by GitHubHigh 8.8
reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24967 · Other software · yogeshojha · reported by GitHubHigh 7.4
reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24966 · Other software · yogeshojha · reported by GitHubMedium 5.3
reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the application, where the Target Organization and Target Description fields accept HTML payloads. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HTML Injection can compromise the application's integrity and user trust. Attackers can execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected. This issue affects all versions up to and including 2.2.0. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24962 · Other software · yogeshojha · reported by GitHubHigh 8.7
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025reNgine is an automated reconnaissance framework for web applications.CVE-2025-24899 · Other software · yogeshojha · reported by GitHubHigh 7.1
reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/torqCVE-2021-27285 · Other software · Inspur · reported by MITREHigh 8.4
An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/torque6/bin/getJobsByShell.
- Product
- Clusterengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.CVE-2024-47221 · Other software · Rapidscada · reported by MITREHigh 7.5
CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.
- Product
- Rapid Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024reNgine is an automated reconnaissance framework for web applications.CVE-2024-43381 · Other software · yogeshojha · reported by GitHubMedium 5
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.
- Product
- rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2024reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.CVE-2023-50094 · Other software · Yogeshojha · reported by MITREHigh 8.8
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.CVE-2022-36566 · Other software · Yogeshojha · reported by MITRECritical 9.8
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2022OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.CVE-2022-1813 · Other software · yogeshojha · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.
- Product
- yogeshojha/rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.CVE-2022-28995 · Other software · Yogeshojha · reported by MITRECritical 9.8
Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box .CVE-2021-39491 · Other software · Rengine Project · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . .
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2022In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if uCVE-2021-46703 · Other software · Razorengine Project · reported by MITRECritical 9.8
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Razorengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021reNgine through 0.5 relies on a predictable directory name.CVE-2021-38606 · Other software · Yogeshojha · reported by MITRECritical 9.8
reNgine through 0.5 relies on a predictable directory name.
- Product
- Rengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0.CVE-2020-21224 · Other software · Inspur · reported by MITRECritical 9.8
A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server
- Product
- Clusterengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2020In GLESRenderEngine, there is a possible out of bounds read due to a buffer overflow.CVE-2020-0359 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In GLESRenderEngine, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150303018
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2018Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-CVE-2018-5755 · Other software · Open-xchange · reported by MITREMedium 5.5
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 14, 2011Stack-based buffer overflow in NFREngine.exe in Novell File Reporter Engine before 1.0.2.53, as used in Novell File Reporter and other products, allows remote aCVE-2011-2220 · Other software · Novell · reported by MITREHigh 10
Stack-based buffer overflow in NFREngine.exe in Novell File Reporter Engine before 1.0.2.53, as used in Novell File Reporter and other products, allows remote attackers to execute arbitrary code via a crafted RECORD element.
- Product
- File Reporter Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.novell.comsecunia.com
Jul 12, 2006Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory frCVE-2006-3552 · Other software · Ipswitch · reported by MITREMedium 6.4
Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory from 20060630 or earlier, does not properly receive and implement bullet signature updates, which allows context-dependent attackers to use the server for spam transmission.
- Product
- Ipswitch Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordipswitch.comipswitch.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.