Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
344new WordPress flaws this week
390,080entries in the database

34 results

  • Jan 12, 2023A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c.CVE-2022-4743 · Other software · Libsdl · reported by Red HatHigh 7.5

    A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

    Product
    Simple Directmedia Layer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 18, 2020In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for CVE-2019-12921 · Other software · Graphicsmagick · reported by MITREMedium 6.5

    In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG.

    Product
    Graphicsmagick
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 19, 2012Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and pCVE-2011-5244 · Other software · Gnome · reported by MITREMedium 6.8

    Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.

    Product
    Evince
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 19, 2012Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote atCVE-2011-0433 · Other software · Gnome · reported by MITREMedium 6.8

    Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.

    Product
    Evince
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 31, 2011Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (apCVE-2011-1554 · Other software · T1lib · reported by MITREMedium 4.3

    Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

    Product
    T1lib
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 31, 2011Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial ofCVE-2011-1553 · Other software · T1lib · reported by MITREMedium 4.3

    Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

    Product
    T1lib
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 31, 2011t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause CVE-2011-1552 · Other software · T1lib · reported by MITREMedium 4.3

    t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

    Product
    T1lib
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 31, 2011t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which aCVE-2011-0764 · Other software · T1lib · reported by cret@cert.orgMedium 6.8

    t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

    Product
    T1lib
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 7, 2011Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products aCVE-2010-2642 · Other software · Redhat · reported by MITREHigh 7.6

    Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

    Product
    Evince
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 7, 2010Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (applicatCVE-2010-1440 · Other software · TUG · reported by Red HatMedium 6.8

    Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 7, 2010Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly exeCVE-2010-0829 · Other software · Jan-ake Larsson · reported by security@ubuntu.comMedium 4.3

    Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file.

    Product
    Dvipng
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 7, 2010Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute CVE-2010-0827 · Other software · TUG · reported by security@ubuntu.comMedium 6.8

    Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file.

    Product
    TEX Live
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 16, 2010Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrCVE-2010-0739 · Other software · TUG · reported by Red HatMedium 6.8

    Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 18, 2010Multiple SQL injection vulnerabilities in Tourism Script Bus Script allow remote attackers to execute arbitrary SQL commands via the sitetext_id parameter to (1CVE-2009-4618 · Other software · Tourismscripts · reported by MITREHigh 7.5

    Multiple SQL injection vulnerabilities in Tourism Script Bus Script allow remote attackers to execute arbitrary SQL commands via the sitetext_id parameter to (1) aboutus.php and (2) faq.php.

    Product
    BUS Script
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 5, 2009Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parCVE-2009-0830 · Other software · Andrew Freed · reported by MITREMedium 4.3

    Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parameters to quotesadd.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

    Product
    Quotebook
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 13, 2007dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files beforCVE-2007-5936 · Other software · Tetex · reported by MITRELow 3.6

    dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 13, 2007Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file withCVE-2007-5935 · Other software · Tetex · reported by MITREMedium 6.8

    Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 13, 2007Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafteCVE-2007-5937 · Other software · Tetex · reported by MITREMedium 6.8

    Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2007Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other pCVE-2007-4352 · Other software · Xpdf · reported by PSIRT-CNA@flexerasoftware.comHigh 7.6

    Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.

    Product
    Xpdf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 1, 2007Buffer overflow in the open_sty function in mkind.c for makeindex 2.14 in teTeX might allow user-assisted remote attackers to overwrite files and possibly execuCVE-2007-0650 · Other software · Makeindex · reported by MITREMedium 6.8

    Buffer overflow in the open_sty function in mkind.c for makeindex 2.14 in teTeX might allow user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. NOTE: other overflows exist but might not be exploitable, such as a heap-based overflow in the check_idx function.

    Product
    Makeindex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 13, 2006Format string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0.9.4 and earlier allows remote attackers to execute arbitrary coCVE-2006-3573 · Other software · Milan Mimica · reported by MITREHigh 10

    Format string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0.9.4 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a player nickname.

    Product
    Sparklet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 22, 2006Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRangCVE-2006-1359 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 9.3

    Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.

    Product
    IE
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possCVE-2005-3627 · Other software · Xpdf · reported by Red HatHigh 7.5

    Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.

    Product
    Xpdf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libCVE-2005-3628 · Other software · Xpdf · reported by Red HatHigh 7.5

    Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.

    Product
    Xpdf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corCVE-2005-3624 · Other software · Easy Software Products · reported by Red HatMedium 5

    The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

    Product
    Cups
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infiniteCVE-2005-3625 · Other software · Easy Software Products · reported by Red HatHigh 10

    Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

    Product
    Cups
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 31, 2005Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) vCVE-2005-3626 · Other software · Easy Software Products · reported by Red HatMedium 5

    Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.

    Product
    Cups
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 7, 2005Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5CVE-2005-3192 · Other software · Xpdf · reported by MITREHigh 7.5

    Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.

    Product
    Xpdf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 2, 2005tetex in Novell Linux Desktop 9 allows local users to determine the existence of arbitrary files via a symlink attack in the /var/cache/fonts directory.CVE-2005-1065 · Other software · Novell · reported by MITRELow 2.1

    tetex in Novell Linux Desktop 9 allows local users to determine the existence of arbitrary files via a symlink attack in the /var/cache/fonts directory.

    Product
    Linux Desktop
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 10, 2005Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.CVE-2004-1125 · Other software · Easy Software Products · reported by MITREHigh 9.3

    Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.

    Product
    Cups
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 23, 2004The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlinkCVE-2004-1336 · Other software · Debian · reported by MITRELow 2.1

    The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack.

    Product
    Tetex-bin
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2004Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method andCVE-2003-0815 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5

    Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.

    Product
    IE
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 28, 2002dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands viCVE-2002-0836 · Other software · HP · reported by MITREHigh 7.5

    dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.

    Product
    Secure OS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 22, 2001teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr.CVE-2001-0906 · Other software · Tetex · reported by MITREMedium 6.2

    teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr.

    Product
    Tetex
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.