Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 30, 2026In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmationCVE-2026-100265 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective.CVE-2026-30302 · Other software · Coderider-kilo · reported by MITRECritical 10
The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser (the Unix-based shell-quote library) to analyze commands on the Windows platform, coupled with a failure to correctly handle Windows CMD-specific escape sequences (^). Attackers can exploit this discrepancy between the parsing logic and the execution environment by constructing payloads such as git log ^" & malicious_command ^". The CodeRider-Kilo parser is deceived by the escape characters, misinterpreting the malicious command connector (&) as being within a protected string argument and thus auto-approving the command. However, the underlying Windows CMD interpreter ignores the escaped quotes, parsing and executing the subsequent malicious command directly. This allows attackers to achieve arbitrary Remote Code Execution (RCE) after bypassing what appears to be a legitimate Git whitelist check.
- Product
- Coderider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Prider: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69072 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion.This issue affects Prider: from n/a through <= 1.1.3.1.
- Product
- Prider
- Affected
- up to 1.1.3.1
- What to do
- Affects up to 1.1.3.1. Update Prider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Grider for Elementor: Missing AuthorizationCVE-2025-66161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.
- Product
- Grider for Elementor
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Grider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2025In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race conditionCVE-2025-64457 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.2
In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
- Product
- ReSharper, Rider and dotTrace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025A vulnerability has been found in RiderLike Fruit Crush-Brain App 1.0 on Android and classified as problematic.CVE-2025-8523 · Other software · RiderLike · reported by VulDBLow 1.9
A vulnerability has been found in RiderLike Fruit Crush-Brain App 1.0 on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.fruitcrush.fun. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Fruit Crush-Brain App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug sessionCVE-2025-43016 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7,CVE-2025-23385 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible
- Product
- ReSharper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possibleCVE-2024-24939 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Aug 3, 2022In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code executionCVE-2022-37396 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 12, 2022EGT-Kommunikationstechnik UG Mediacenter before v2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Online_Update.php.CVE-2022-31904 · Other software · Uberrider · reported by MITREMedium 6.1
EGT-Kommunikationstechnik UG Mediacenter before v2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Online_Update.php.
- Product
- Mediacenter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduberrider.deuberrider.de
May 24, 2022A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3.CVE-2014-125001 · Other software · Cardo Systems · reported by VulDBHigh 8.1
A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.
- Product
- Scala Rider Q3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordremote-exploit.orgvuldb.com
Apr 28, 2022In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possibleCVE-2022-29821 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jan 30, 2020In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer.CVE-2020-7906 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.CVE-2019-14960 · Other software · Jetbrains · reported by MITREHigh 7.8
JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 29, 2018strider-sauce is Sauce Labs / Selenium support for Strider.CVE-2016-10611 · Other software · HackerOne · reported by support@hackerone.comHigh 8.1
strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
- Product
- strider-sauce node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Sep 10, 2009Directory traversal vulnerability in _css/js.php in Elgg 1.5, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a ..CVE-2009-3149 · Other software · Curveriderhq · reported by MITREMedium 4.3
Directory traversal vulnerability in _css/js.php in Elgg 1.5, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the js parameter. NOTE: some of these details are obtained from third party information.
- Product
- Elgg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Jan 26, 2006Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtainCVE-2006-0439 · Other software · Text Rider · reported by MITREMedium 5
Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt.
- Product
- Text Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2006Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possiblyCVE-2006-0440 · Other software · Text Rider · reported by MITREMedium 5
Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.
- Product
- Text Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevuln.comsecuritytracker.com
Dec 1, 2005SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.CVE-2005-3931 · Other software · Asp-rider · reported by MITREHigh 7.5
SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.
- Product
- Asp-rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Dec 31, 2004SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username paCVE-2004-1401 · Other software · Asp-rider · reported by MITREHigh 7.5
SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter.
- Product
- Asp-rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.