Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Sep 30, 2026Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-suppCVE-2026-10739 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 8.5
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledge.catonetworks.com
Sep 30, 2026Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability.CVE-2026-10726 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 6.8
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledge.catonetworks.com
Jul 1, 2026Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 oCVE-2026-12374 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 6.4
Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Apr 27, 2025An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool coCVE-2025-3886 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 5.7
An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool component.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28.CVE-2024-6978 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 5.6
Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10.28.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover.CVE-2024-6977 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 6.5
A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file.CVE-2024-6975 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 8.8
Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.CVE-2024-6974 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 8.8
Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Jul 31, 2024Remote Code Execution in Cato Windows SDP client via crafted URLs.CVE-2024-6973 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bHigh 7.5
Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34.
- Product
- SDP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.catonetworks.com
Dec 13, 2019In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.CVE-2019-19793 · Other software · Cyxtera · reported by MITREHigh 8.8
In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.
- Product
- Appgate SDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddanishcyberdefence.dkcyxtera.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.