Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
May 29, 2026Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.CVE-2026-44611 · Other software · Danelec · reported by ics-cert@hq.dhs.govMedium 5.9
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
- Product
- MacGregor Voyage Data Recorder (VDR) G4e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.CVE-2026-42951 · Other software · Danelec · reported by ics-cert@hq.dhs.govMedium 5.9
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.
- Product
- MacGregor Voyage Data Recorder (VDR) G4e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.CVE-2026-42941 · Other software · Danelec · reported by ics-cert@hq.dhs.govHigh 8.7
The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.
- Product
- MacGregor Voyage Data Recorder (VDR) G4e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.CVE-2026-42929 · Other software · Danelec · reported by ics-cert@hq.dhs.govHigh 8.7
Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.
- Product
- MacGregor Voyage Data Recorder (VDR) G4e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentiallyCVE-2026-40425 · Other software · Danelec · reported by ics-cert@hq.dhs.govMedium 6.9
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
- Product
- MacGregor Voyage Data Recorder (VDR) G4e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems.CVE-2023-53774 · Other software · MiniDVBLinux · reported by VulnCheckMedium 6.9
MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to execute messages and potentially control the video disk recorder remotely.
- Product
- Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comlinuxtv.org
Jun 15, 2023In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition.CVE-2023-21101 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-258189255
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 13, 2017An issue was discovered in INTERSCHALT Maritime Systems VDR G4e Versions 5.220 and prior.CVE-2016-9339 · Other software · Macgregor · reported by ics-cert@hq.dhs.govMedium 5.3
An issue was discovered in INTERSCHALT Maritime Systems VDR G4e Versions 5.220 and prior. External input is used to construct paths to files and directories without properly neutralizing special elements within the pathname that could allow an attacker to read files on the system, a Path Traversal.
- Product
- Interschalt VDR G4e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jan 29, 2016Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attackers to cause a denial of service (system crCVE-2015-8773 · Other software · Mcafee · reported by MITREHigh 7.5
Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attackers to cause a denial of service (system crash) via a long vault GUID in an ioctl call.
- Product
- File Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgnettitude.co.uk
Jan 29, 2016McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denialCVE-2015-8772 · Other software · Mcafee · reported by MITRECritical 9.1
McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
- Product
- File Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgnettitude.co.uk
Oct 20, 2010vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a TroCVE-2010-3387 · Other software · Tvdr · reported by MITREMedium 6.9
vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended
- Product
- VDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.debian.org
Nov 6, 2008vdrleaktest in Video Disk Recorder (aka vdr-dbg or vdr) 1.6.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/memleaktest.log tCVE-2008-4985 · Other software · Cadsoft · reported by MITREMedium 6.9
vdrleaktest in Video Disk Recorder (aka vdr-dbg or vdr) 1.6.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/memleaktest.log temporary file.
- Product
- VDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgdev.gentoo.org
May 2, 2005vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.CVE-2005-0071 · Other software · VDR · reported by MITREMedium 5
vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.
- Product
- VDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.