Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Aug 28, 2026Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information sCVE-2026-51617 · Other software · reported by MITREHigh 7.5
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2024In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.CVE-2024-31817 · Other software · totolink · reported by MITREHigh 7.5
In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.
- Product
- ex200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2023sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c.CVE-2023-33204 · Other software · Sysstat Project · reported by MITREHigh 7.8
sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 8, 2022sysstat is a set of system performance tools for the Linux operating system.CVE-2022-39377 · Other software · sysstat · reported by GitHubHigh 7
sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.
- Product
- sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 3, 2022In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg.CVE-2021-42893 · Other software · Totolink · reported by MITREHigh 7.5
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2019sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.CVE-2019-19725 · Other software · Sysstat Project · reported by MITRECritical 9.8
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 9, 2019sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.CVE-2019-16167 · Other software · Sysstat Project · reported by MITREMedium 5.5
sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Nov 24, 2018An issue was discovered in sysstat 12.1.1.CVE-2018-19517 · Other software · Sysstat Project · reported by MITREMedium 5.5
An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2018An issue was discovered in sysstat 12.1.1.CVE-2018-19416 · Other software · Sysstat Project · reported by MITREHigh 7.8
An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 16, 2018Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated CVE-2018-5728 · Other software · Cobham · reported by MITREMedium 5.3
Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details.
- Product
- Seatel 121 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmisteralfa-hack.blogspot.clmisteralfa-hack.blogspot.cl
Aug 14, 2007The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.CVE-2007-3852 · Other software · Sysstat · reported by Red HatMedium 4.4
The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2004The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a diffeCVE-2004-0107 · Other software · Redhat · reported by MITREMedium 4.6
The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comciac.org
Apr 15, 2004The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerabiliCVE-2004-0108 · Other software · Redhat · reported by MITREMedium 4.6
The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107.
- Product
- Sysstat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comdebian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.