Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 11, 2026A security flaw has been discovered in FunnyWolf Viper up to 3.1.11.CVE-2026-108584 · Other software · FunnyWolf · reported by VulDBMedium 5.5
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- Viper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode.CVE-2025-11065 · Other software · Red Hat · reported by Red HatMedium 5.3
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
- Product
- OpenShift Pipelines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 3, 2025ViperBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This issue affects ViperBar: from n/a through <= 2.0.
- Product
- ViperBar
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update ViperBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024WP-ViperGB: Cross-Site Request ForgeryCVE-2024-4409 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP-ViperGB
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update WP-ViperGB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2022BD Viper LT system, versions 2.0 and later, contains hardcoded credentials.CVE-2022-22765 · Other software · Becton Dickinson (BD) · reported by cybersecurity@bd.comHigh 8
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). BD Viper LT system versions 4.0 and later utilize Microsoft Windows 10 and have additional Operating System hardening configurations which increase the attack complexity required to exploit this vulnerability.
- Product
- BD Viper LT System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurity.bd.comcisa.gov
Mar 6, 2020Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control.CVE-2020-9756 · Other software · Patriotmemory · reported by MITREHigh 7.8
Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privileges to read/write 1/2/4 bytes from or to an IO port. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
- Product
- Viper RGB Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoresecurity.comcoresecurity.com
Feb 21, 2020A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040.CVE-2019-19452 · Other software · Patriotmemory · reported by MITREHigh 7.8
A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrity processes) can exploit this to gain NT AUTHORITY\SYSTEM privileges.
- Product
- Viper RGB Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoresecurity.comviper.patriotmemory.com
Nov 9, 2019The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memorCVE-2019-18845 · Other software · Patriotmemory · reported by MITREHigh 7.1
The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.
- Product
- Viper RGB Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2019The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.CVE-2015-9356 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
- Product
- wp-vipergb
- Fixed in
- 1.3.16
- What to do
- Update wp-vipergb to 1.3.16 or newer.
Full record and what to do →NVD recordmake.wordpress.orgwordpress.org
Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authenticatCVE-2014-9460 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) vgb_page or (3) vgb_items_per_pg parameter in the wp-vipergb page to wp-admin/options-general.php.
- Product
- Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB
- Fixed in
- 1.3.11
- What to do
- Update Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB to 1.3.11 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Mar 20, 2007PHP remote file inclusion vulnerability in index.php in ViperWeb Portal alpha 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the modpathCVE-2007-1514 · Other software · Viperweb · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in index.php in ViperWeb Portal alpha 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the modpath parameter.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.