Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Dec 30, 2025When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g.CVE-2025-14987 · Other software · Temporal · reported by security@temporal.ioMedium 5.3
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
- Product
- Temporal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Hard-coded credentials in the B.CVE-2020-25168 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govLow 3.3
Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers with command line access to access the device’s Wi-Fi module.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022An improper verification of the cryptographic signature of firmware updates of the B.CVE-2020-25166 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.6
An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper with devices.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A vulnerability in the B.CVE-2020-25164 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 6.5
A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to recover user credentials of the administrative interface.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A XPath injection vulnerability in the B.CVE-2020-25162 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.5
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Improper access controls in the B.CVE-2020-25160 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 6.8
Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A reflected cross-site scripting (XSS) vulnerability in the B.CVE-2020-25158 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.6
A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Active debug code in the B.CVE-2020-25156 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.2
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022An open redirect vulnerability in the administrative interface of the B.CVE-2020-25154 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 5.4
An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A session fixation vulnerability in the B.CVE-2020-25152 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 6.5
A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A relative path traversal attack in the B.CVE-2020-25150 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.6
A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A vulnerability in the configuration import mechanism of the B.CVE-2020-16238 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govMedium 6.7
A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021An improper sanitization of input vulnerability in B.CVE-2021-33886 · Other software · Bbraun · reported by MITREHigh 8.1
An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.
- Product
- Spacecom2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraunusa.commcafee.com
Aug 25, 2021An Insufficient Verification of Data Authenticity vulnerability in B.CVE-2021-33885 · Other software · Bbraun · reported by MITRECritical 10
An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.
- Product
- Spacecom2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraunusa.commcafee.com
Aug 25, 2021An Unrestricted Upload of File with Dangerous Type vulnerability in B.CVE-2021-33884 · Other software · Bbraun · reported by MITREMedium 6.5
An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten.
- Product
- Spacecom2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraunusa.commcafee.com
Aug 25, 2021A Cleartext Transmission of Sensitive Information vulnerability in B.CVE-2021-33883 · Other software · Bbraun · reported by MITREMedium 5.9
A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.
- Product
- Spacecom2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraunusa.commcafee.com
Aug 25, 2021A Missing Authentication for Critical Function vulnerability in B.CVE-2021-33882 · Other software · Bbraun · reported by MITREMedium 6.8
A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.
- Product
- Spacecom2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbraunusa.commcafee.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.