Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

333new WordPress flaws this week

390,007entries in the database

32 results

Oct 9, 2026SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalCVE-2026-104084 · Other software · Smartertools · reported by VulnCheckHigh 8.7
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.evan.lat smartertools.com
Oct 9, 2026SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing CVE-2026-104083 · Other software · Smartertools · reported by VulnCheckMedium 5.3
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.evan.lat smartertools.com
Oct 9, 2026SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the VolumeCVE-2026-104082 · Other software · Smartertools · reported by VulnCheckHigh 8.6
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.evan.lat smartertools.com
May 8, 2026SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authentCVE-2026-7807 · Other software · SmarterTools Inc. · reported by VulnCheckHigh 8.7
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
Product
SmarterMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com vulncheck.com
Apr 27, 2026SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys andCVE-2026-40514 · Other software · SmarterTools Inc. · reported by VulnCheckHigh 8.2
SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens for arbitrary emails, attachments, or file storage contents without prior access to the targeted content.
Product
SmarterMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com vulncheck.com
Feb 16, 2026SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.CVE-2026-26930 · Other software · SmarterTools · reported by MITREHigh 7.2
SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.
Product
SmarterMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com smartertools.com
Jan 29, 2026SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint.CVE-2026-25067 · Other software · SmarterTools · reported by VulnCheckMedium 6.9
SmarterTools SmarterMail versions prior to build 9518 contain an unauthenticated path coercion vulnerability in the background-of-the-day preview endpoint. The application base64-decodes attacker-supplied input and uses it as a filesystem path without validation. On Windows systems, this allows UNC paths to be resolved, causing the SmarterMail service to initiate outbound SMB authentication attempts to attacker-controlled hosts. This can be abused for credential coercion, NTLM relay attacks, and unauthorized network authentication.
Product
SmarterMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com vulncheck.com
Jan 23, 2026SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVE-2026-24423 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.
Product
SmarterMail
On CISA’s list since
Feb 5, 2026 (federal fix deadline Feb 26, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog code-white.com smartertools.com
Jan 22, 2026SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVE-2026-23760 · Other software · SmarterTools · reported by VulnCheckExploitedRansomwareCritical 9.3
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog code-white.com labs.watchtowr.com
Dec 28, 2025SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2025-52691 · Other software · SmarterTools · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4ExploitedRansomwareCritical 10
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Product
SmarterMail
On CISA’s list since
Jan 26, 2026 (federal fix deadline Feb 16, 2026)
What to do
Attackers are using this now. Install SmarterTools’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csa.gov.sg github.com
Dec 21, 2023SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.CVE-2023-48116 · Other software · Smartertools · reported by MITREMedium 5.4
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record co3us.gitbook.io smartertools.com
Dec 21, 2023SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainTexCVE-2023-48115 · Other software · Smartertools · reported by MITREMedium 5.4
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record co3us.gitbook.io smartertools.com
Dec 21, 2023SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document.CVE-2023-48114 · Other software · Smartertools · reported by MITREMedium 5.4
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record co3us.gitbook.io smartertools.com
Nov 17, 2021SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.CVE-2021-43977 · Other software · Smartertools · reported by MITREMedium 6.1
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl smartertools.com
Nov 17, 2021SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.CVE-2021-32234 · Other software · Smartertools · reported by MITRECritical 9.8
SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl smartertools.com
Sep 8, 2021SmarterTools SmarterMail 16.x before build 7866 has stored XSS.CVE-2021-40377 · Other software · Smartertools · reported by MITREMedium 5.4
SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com smartertools.com
Aug 17, 2021An issue was discovered in SmarterTools SmarterMail through 100.0.7537.CVE-2020-29548 · Other software · Smartertools · reported by MITREHigh 8.1
An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, injecting plaintext commands into an encrypted user session.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nostarttls.secvuln.info smartertools.com
Jul 5, 2021SmarterTools SmarterMail before Build 7776 allows XSS.CVE-2021-32233 · Other software · Smartertools · reported by MITREMedium 6.1
SmarterTools SmarterMail before Build 7776 allows XSS.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartertools.com smartertools.com
Apr 24, 2019SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.CVE-2019-7214 · Other software · Smartertools · reported by MITRECritical 9.8
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Apr 24, 2019SmarterTools SmarterMail 16.x before build 6985 allows directory traversal.CVE-2019-7213 · Other software · Smartertools · reported by MITREMedium 6.5
SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside the web directories.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nccgroup.trust smartertools.com
Apr 24, 2019SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys.CVE-2019-7212 · Other software · Smartertools · reported by MITREHigh 8.2
SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nccgroup.trust smartertools.com
Apr 24, 2019SmarterTools SmarterMail 16.x before build 6995 has stored XSS.CVE-2019-7211 · Other software · Smartertools · reported by MITREMedium 6.1
SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nccgroup.trust smartertools.com
Jan 16, 2019SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms.CVE-2015-9276 · Other software · Smartertools · reported by MITREMedium 6.1
SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nccgroup.trust nccgroup.trust
Sep 19, 2012Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body CVE-2012-2578 · Other software · Smartertools · reported by cret@cert.orgMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a JavaScript alert function used in conjunction with the fromCharCode method, (2) a SCRIPT element, (3) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element, or (4) an innerHTML attribute within an XML document.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Sep 22, 2010Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slashCVE-2010-3486 · Other software · Smartertools · reported by MITREMedium 5
Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudscan.blogspot.com packetstormsecurity.org
Apr 16, 2008Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service terminaCVE-2008-1854 · Other software · Smartertools · reported by MITREMedium 5
Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Feb 21, 2008Cross-site scripting (XSS) vulnerability in SmarterTools SmarterMail Enterprise 4.3 allows remote attackers to inject arbitrary web script or HTML via a STYLE aCVE-2008-0872 · Other software · Smartertools · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in SmarterTools SmarterMail Enterprise 4.3 allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute of an element in the Subject field of an e-mail message.
Product
Smartermail Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record es.geocities.com secunia.com
Dec 31, 2004frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or renamCVE-2004-2584 · Other software · Smartertools · reported by MITREMedium 4
frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record members.lycos.co.uk zone-h.org
Dec 31, 2004login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly dueCVE-2004-2587 · Other software · Smartertools · reported by MITREMedium 5
login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer overflow.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record members.lycos.co.uk secunia.com
Dec 31, 2004Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files viaCVE-2004-2586 · Other software · Smartertools · reported by MITREMedium 5
Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record members.lycos.co.uk secunia.com
Dec 31, 2004Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web scCVE-2004-2585 · Other software · Smartertools · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record members.lycos.co.uk secunia.com
Dec 31, 2004SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simuCVE-2004-2583 · Other software · Smartertools · reported by MITREHigh 7.8
SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.
Product
Smartermail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record members.lycos.co.uk secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.