Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34 results
Oct 19, 2026Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.CVE-2026-110677 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 19, 2026Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.CVE-2026-110674 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 13, 2026Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.CVE-2026-92088 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.6
Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. This issue affects upKeeper Instant Privilege Access: through 1.7.1.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Total Upkeep: Does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated usersCVE-2026-16253 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.
- Product
- Total Upkeep
- Fixed in
- 1.17.3
- What to do
- Update Total Upkeep to 1.17.3 or newer.
Aug 6, 2026Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.CVE-2026-66708 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
- Affected
- up to 1.17.2
- What to do
- Affects up to 1.17.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 24, 2026Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging.CVE-2026-10745 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 7.9
Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging. This issue affects upKeeper Instant Privilege Access: through 1.6.1.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.CVE-2026-9334 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.3
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
May 1, 2026Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Unauthorized modification of dataCVE-2026-3143 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.17.1
- What to do
- Affects up to 1.17.1. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 14, 2026.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of ExecutCVE-2026-2450 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 7.4
.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows CVE-2026-2449 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 9
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), thCVE-2026-1442 · Other software · Unitree · reported by cve@takeonme.orgHigh 7.8
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
- Product
- UPK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtakeonme.orggithub.com
Feb 10, 2026PopupKit: Authorization bypassCVE-2025-14895 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.
- Product
- PopupKit
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 6, 2026Popupkit: Arbitrary subscriber data deletionCVE-2025-14441 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_callback` only validating wp_rest nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary subscriber records.
- Product
- Popupkit
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Popupkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025PopupKit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
- Product
- PopupKit
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PopupKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-14314 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Injection.This issue affects PopupKit: from n/a through <= 2.1.5.
- Product
- PopupKit
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2025Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects CVE-2025-11446 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 7.3
Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects CVE-2025-8663 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.8
Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.0.0 before 5.2.12.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Sensitive Information ExposureCVE-2020-36848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.14.9
- What to do
- Affects up to 1.14.9. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgraw.githubusercontent.com
Jun 10, 2025Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant PCVE-2025-4681 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.6
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant Privilege Access: before 1.4.0.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control SecurityCVE-2025-4680 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.6
Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2025-2257 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.10
- What to do
- Affects up to 1.16.10. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.svn.wordpress.org
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.8
- What to do
- Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2024-9461 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.6
- What to do
- Affects up to 1.16.6. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 20, 2024Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper InstCVE-2024-9479 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 10
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper InstCVE-2024-9478 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 10
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2.
- Product
- upKeeper Instant Privilege Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue afCVE-2024-42466 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 9.5
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue afCVE-2024-42465 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 9
Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System ResourCVE-2024-42464 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 7.6
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System ResourCVE-2024-42463 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fHigh 8.6
Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2024Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5CVE-2024-42462 · Other software · upKeeper Solutions · reported by 80f39f49-2521-4ee7-9e17-af5d55e8032fCritical 10
Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5.1.9.
- Product
- upKeeper Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024Total Upkeep: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-24869 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue affects Total Upkeep: from n/a through 1.15.8.
- Product
- Total Upkeep
- Affected
- up to 1.15.8
- What to do
- Affects up to 1.15.8. Update Total Upkeep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 7, 2023Total Upkeep: Information disclosureCVE-2022-4932 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
- Product
- Total Upkeep
- Affected
- up to 1.14.13
- What to do
- Affects up to 1.14.13. Update Total Upkeep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 11, 2022Windows BackupKey Remote Protocol Security Feature Bypass VulnerabilityCVE-2022-21925 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 15, 2017Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.CVE-2017-16788 · Other software · Meinbergglobal · reported by MITREHigh 7.2
Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploading a file, as demonstrated by storing a file in the cron.d directory.
- Product
- Lantime Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.