Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 1 of 2
Oct 22, 2026Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103634 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 10, 2026Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103636 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 10, 2026Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103635 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 10, 2026Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103513 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 10, 2026Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103501 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Sep 10, 2026FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS).CVE-2026-36392 · Other software · reported by MITREMedium 5.4
FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2026In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not providCVE-2026-64365 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2026A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciCVE-2026-9264 · Other software · Trimble · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Critical 9.3
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2025-15062 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27769.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2026A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0.CVE-2026-0842 · Other software · Flycatcher Toys · reported by VulDBLow 2.1
A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- smART Sketcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41106 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'first_name' in '/clients/save_contact/'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41105 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/tickets/save'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41104 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41103 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41102 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user iCVE-2025-41101 · Other software · Fairsketch · reported by cve-coordination@incibe.esMedium 5.1
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'.
- Product
- RISE CRM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions.CVE-2025-63293 · Other software · Fairsketch · reported by MITREMedium 6.5
FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.
- Product
- Rise Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.CVE-2025-60749 · Other software · reported by MITREHigh 7.8
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sketchup.comyawataa.github.io
Oct 10, 2025Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.CVE-2025-60378 · Other software · Fairsketch · reported by MITREHigh 8.1
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
- Product
- Rise Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using tCVE-2025-56807 · Other software · Fairsketch · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders.
- Product
- Rise Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability.CVE-2025-2024 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25210.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Pro SKP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2024-7511 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comMedium 5.5
Trimble SketchUp Pro SKP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trimble SketchUp Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files embedded in SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23000.
- Product
- SketchUp Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-7510 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19631.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-7509 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19576.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-7508 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19575.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-9731 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24145.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2024-9730 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24146.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9729 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24144.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9728 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24112.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9727 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24111.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-9726 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24110.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9725 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24109.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9724 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24108.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9723 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24107.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9722 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9721 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24105.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-9720 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24104.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9719 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24103.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2024-9718 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24102.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability.CVE-2024-9717 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24101.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9716 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9715 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24098.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9714 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24097.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp Pro SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9713 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Pro SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23885.
- Product
- SketchUp Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2024-9712 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23530.
- Product
- SketchUp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2024Sketchfab Embed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37216 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.This issue affects Sketchfab Embed: from n/a through 1.5.
- Product
- Sketchfab Embed
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Sketchfab Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2023-50196 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21800.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2023-50195 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21799.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2023-50194 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21788.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2023-50193 · Other software · Trimble · reported by zdi-disclosures@trendmicro.comHigh 7.8
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21787.
- Product
- SketchUp Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.