Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
253 results · page 1 of 6
Oct 21, 2026Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing tokCVE-2026-114662 · Other software · obot-platform · reported by VulnCheckHigh 8.6
Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resulting non-expiring API key to take over the victim's account.
- Product
- obot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controCVE-2026-112303 · Other software · GDevelop · reported by VulnCheckMedium 5.3
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
- Product
- GDevelop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes CVE-2026-111622 · Other software · a466350665 · reported by VulnCheckHigh 7.6
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
- Product
- smart-sso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount tCVE-2026-110220 · Other software · Kubeflow · reported by VulnCheckHigh 7.1
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
- Product
- Model Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user'sCVE-2026-109286 · Other software · open-webui · reported by VulnCheckHigh 8.6
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 6, 2026Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely coCVE-2026-106039 · Other software · kvcache-ai · reported by VulnCheckMedium 6.9
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
- Product
- Mooncake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previouslyCVE-2026-57967 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
- Product
- Apache Artemis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 17, 2026Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2026-22072 · Other software · OPPO · reported by security@oppo.comHigh 8.3
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
- Product
- OPPO Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leavesCVE-2026-68426 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 31, 2026Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens aCVE-2026-18481 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.2
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
- Product
- AWS Ops Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jul 23, 2026Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials viaCVE-2026-50044 · Other software · Pronetiqs · reported by ics-cert@hq.dhs.govHigh 7.6
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.
- Product
- Panduit Intravue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cCVE-2026-53395 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_acl) { if (create->cr_dpacl || create->cr_pacl) /* always false */ When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion. Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 17, 2026SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from CVE-2026-63094 · Other software · SigNoz · reported by VulnCheckHigh 7.6
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
- Product
- signoz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM.CVE-2026-41860 · Other software · Cloud Foundry Foundation · reported by security@vmware.comHigh 7.1
CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials. Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
- Product
- BOSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper wCVE-2026-41859 · Other software · Cloud Foundry Foundation · reported by security@vmware.comHigh 7.1
A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms). Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later
- Product
- BOSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs.CVE-2026-23809 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.4
A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.
- Product
- HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorizatiCVE-2026-25649 · Other software · traccar · reported by GitHubHigh 7.3
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments.CVE-2026-26068 · Other software · jm33-m0 · reported by GitHubCritical 9.3
emp3r0r is a stealth-focused C2 designed by Linux users for Linux environments. Prior to 3.21.1, untrusted agent metadata (Transport, Hostname) is accepted during check-in and later interpolated into tmux shell command strings executed via /bin/sh -c. This enables command injection and remote code execution on the operator host. This vulnerability is fixed in 3.21.1.
- Product
- emp3r0r
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation.CVE-2023-53957 · Other software · Kimai · reported by VulnCheckHigh 8.5
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
- Product
- Kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 4, 2025TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cooCVE-2025-66574 · Other software · Compass Plustechologies · reported by VulnCheckMedium 5.3
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.
- Product
- TranzAxis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompassplustechnologies.comexploit-db.com
Nov 4, 2025The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input anCVE-2025-12695 · Other software · reported by reefs@jfrog.comMedium 5.9
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-58590 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2025-27388 · Other software · OPPO · reported by security@oppo.comHigh 8.3
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
- Product
- OPPO HEALTH APP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controCVE-2025-51471 · Other software · Ollama · reported by MITREMedium 6.9
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
- Product
- Ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entrCVE-2025-6741 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.4.0 * Devolutions Server 2025.1.11.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' CVE-2020-26799 · Other software · reported by MITRECritical 9.8
A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuryadina.comluxsoft.eu
Jun 9, 2025Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the sessioCVE-2025-49651 · Other software · Lablup · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.1
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.
- Product
- BackendAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.CVE-2025-27720 · Other software · Pixmeo · reported by ics-cert@hq.dhs.govCritical 9.3
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
- Product
- OsiriX MD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govosirix-viewer.com
Apr 17, 2025CWD – Stealth Links: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22655 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through <= 1.3.
- Product
- CWD – Stealth Links
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update CWD – Stealth Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the dCVE-2025-2859 · Other software · Arteche · reported by cve-coordination@incibe.esMedium 6.9
An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
- Product
- saTECH BCU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data.CVE-2024-7819 · Other software · danswer-ai · reported by security@huntr.devHigh 7.4
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.
- Product
- danswer-ai/danswer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation.CVE-2025-20620 · Other software · Y'S corporation · reported by vultures@jpcert.or.jpHigh 7.5
SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page.
- Product
- STEALTHONE D220
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation.CVE-2025-20055 · Other software · Y'S corporation · reported by vultures@jpcert.or.jpCritical 9.8
OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command.
- Product
- STEALTHONE D220
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation.CVE-2025-20016 · Other software · Y'S corporation · reported by vultures@jpcert.or.jpHigh 7.2
OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.
- Product
- STEALTHONE D220
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an unauthenticated, CVE-2022-20663 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.Attention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see .
- Product
- Cisco Secure Network Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 29, 2024A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settingCVE-2024-6674 · Other software · parisneo · reported by security@huntr.devHigh 7.1
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.
- Product
- parisneo/lollms-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the srCVE-2024-41708 · Other software · adacore · reported by MITREHigh 7.5
An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module.
- Product
- ada_web_services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.adacore.comgithub.com
Sep 23, 2024A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitCVE-2024-8770 · Other software · GitHub · reported by product-cna@github.comMedium 5.8
A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Sep 18, 2024An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions CVE-2024-8890 · Other software · CIRCUTOR · reported by cve-coordination@incibe.esHigh 8
An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being established.
- Product
- CIRCUTOR Q-SMT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have nCVE-2024-8888 · Other software · CIRCUTOR · reported by cve-coordination@incibe.esCritical 10
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
- Product
- CIRCUTOR Q-SMT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and stealCVE-2020-24061 · Other software · kasda · reported by MITREMedium 4.3
Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script
- Product
- kw5515
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and sCVE-2024-42008 · Websites & servers · Roundcube · reported by MITRECritical 9.3
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session CVE-2024-6739 · Other software · Openfind · reported by twcert@cert.org.twMedium 5.3
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
- Product
- MailGates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenfind.com.twtwcert.org.tw
Jul 9, 2024In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code.CVE-2024-34723 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 8, 2024A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containiCVE-2024-5549 · Other software · stitionai · reported by security@huntr.devHigh 8.1
A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as deleting projects or sending messages. The issue arises from the lack of proper origin validation, allowing unauthorized cross-origin requests to be executed. The vulnerability is present in all versions of the repository, as no fixed version has been specified.
- Product
- stitionai/devika
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.CVE-2024-29851 · Other software · Veeam · reported by support@hackerone.comHigh 7.2
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
- Product
- Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system.CVE-2023-38002 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208.
- Product
- Storage Scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 16, 2024Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protectiCVE-2024-31503 · Other software · dolibarr · reported by MITREHigh 7.5
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data lCVE-2024-2196 · Other software · aimhubio · reported by security@huntr.devHigh 8.8
aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboard. An attacker can exploit this by tricking a user into executing a malicious script that sends unauthorized requests to the aim server, leading to potential data loss and unauthorized data manipulation.
- Product
- aimhubio/aim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2024An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.CVE-2024-23758 · Other software · unisys · reported by MITREHigh 7.5
An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.
- Product
- stealth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.compublic.support.unisys.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.