Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Sep 21, 2026luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound.CVE-2026-55159 · Other software · openwrt · reported by GitHubHigh 8.8
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
- Product
- luci-app-adblock-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026A security flaw has been discovered in pymumu SmartDNS up to 47.1.CVE-2026-1425 · Other software · pymumu · reported by VulDBMedium 6.3
A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.
- Product
- SmartDNS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access.CVE-2024-42643 · Other software · smartdns_project · reported by MITREHigh 7.5
Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access.
- Product
- smartdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.CVE-2024-24199 · Other software · pymumu · reported by MITREHigh 7.5
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.
- Product
- smartdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.CVE-2024-24198 · Other software · pymumu · reported by MITREHigh 7.5
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.
- Product
- smartdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file, CVE-2023-31470 · Other software · Pymumu · reported by MITRECritical 9.8
SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file, via a crafted DNS request.
- Product
- Smartdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.