Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Jan 15, 2026An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to theCVE-2026-22919 · Other software · SICK AG · reported by psirt@sick.deLow 3.8
An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leadCVE-2026-22918 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.CVE-2026-22917 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leadinCVE-2026-22916 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information.CVE-2026-22915 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.CVE-2026-22914 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login.CVE-2026-22913 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication.CVE-2026-22912 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access toCVE-2026-22911 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access.CVE-2026-22910 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disruptiCVE-2026-22909 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.CVE-2026-22908 · Other software · SICK AG · reported by psirt@sick.deCritical 9.1
Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-22907 · Other software · SICK AG · reported by psirt@sick.deCritical 9.9
An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.