Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
152 results · page 1 of 4
Oct 13, 2026NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow.CVE-2026-67456 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.4
NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.
- Product
- Warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 25, 2026The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.CVE-2026-100248 · Other software · Rattadan · reported by MITREHigh 8.4
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
- Product
- Cosmowarp Contract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-91167 · Other software · warp-tech · reported by GitHubMedium 6
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-91166 · Other software · warp-tech · reported by GitHubMedium 5.7
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-91165 · Other software · warp-tech · reported by GitHubLow 2.4
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-91164 · Other software · warp-tech · reported by GitHubMedium 4.3
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-63330 · Other software · warp-tech · reported by GitHubHigh 7.7
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-63329 · Other software · warp-tech · reported by GitHubMedium 4.9
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-58491 · Other software · warp-tech · reported by GitHubCritical 9.3
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paCVE-2026-90308 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev->qp_xa and then use or reference them outside the xarray lock. erdma_destroy_qp() can drop the destroy-path reference and free QP resources while such a lookup is in flight. Add erdma_qp_get_by_qpn() to acquire a kref under the xarray lock with kref_get_unless_zero(). Remove the QP from the xarray before dropping the destroy-path reference so no new lookup can acquire it while destruction waits for existing users.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_paCVE-2026-90823 · Other software · FatPipe Networks · reported by contact@securifera.comCritical 9.8
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
- Product
- MPVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatpipeinc.comsecurifera.com
Sep 17, 2026FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daCVE-2026-90822 · Other software · FatPipe Networks · reported by contact@securifera.comCritical 9.8
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).
- Product
- MPVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatpipeinc.comsecurifera.com
Sep 14, 2026A flaw has been found in michaelliao itranswarp up to 2.19.CVE-2026-90835 · Other software · michaelliao · reported by VulDBLow 2
A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- itranswarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.CVE-2026-90507 · Other software · vvbbnn00 · reported by VulDBLow 2.1
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WARP-Clash-API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 13, 2026A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.CVE-2026-90506 · Other software · vvbbnn00 · reported by VulDBLow 1.3
A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WARP-Clash-API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 13, 2026A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.CVE-2026-90505 · Other software · vvbbnn00 · reported by VulDBLow 1.3
A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WARP-Clash-API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 13, 2026A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.CVE-2026-90504 · Other software · vvbbnn00 · reported by VulDBMedium 5.5
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- WARP-Clash-API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jun 24, 2026Warp is an agentic development environment.CVE-2026-54699 · Other software · warpdotdev · reported by GitHubHigh 7.7
Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user opens the link. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-54686 · Other software · warpdotdev · reported by GitHubMedium 4.3
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An attacker who could cause a victim to view attacker-controlled terminal output in Warp could spoof selected lifecycle metadata, including the current working directory reported for the active block or SSH session transport metadata. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48732 · Other software · warpdotdev · reported by GitHubHigh 8.8
Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for SSH-backed metadata collection. A remote host, repository, or directory name controlled by an attacker could cause that helper command to execute additional shell syntax on the remote host as the victim's authenticated SSH account. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48731 · Other software · warpdotdev · reported by GitHubHigh 7.8
Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expanded command through a shell. A user who opens an attacker-controlled local file path through an affected external editor or system-default editor route can cause shell syntax embedded in that path to execute as the local user. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48725 · Other software · warpdotdev · reported by GitHubHigh 8.1
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access to the local system clipboard. A malicious remote host, remote program, or other attacker-controlled terminal output source can trigger clipboard reads or writes without a separate confirmation step. This crosses the trust boundary between untrusted terminal output and the user's local desktop clipboard. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48721 · Other software · warpdotdev · reported by GitHubHigh 8.6
Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48720 · Other software · warpdotdev · reported by GitHubHigh 8.8
Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` payloads from terminal output and materialize the decoded payload as a local file without an additional confirmation step. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48719 · Other software · warpdotdev · reported by GitHubHigh 8
Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection in the prompt branch selector. A user who can publish a branch to a Git repository opened in Warp can cause a crafted branch name to be interpreted by the victim's shell if the victim selects that branch from the UI. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48704 · Other software · warpdotdev · reported by GitHubHigh 8.8
Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal rendered content. If a user opens the Markdown in Warp and clicks the link, affected builds may route the resolved local file to a platform file opener instead of limiting the action to safe viewer/editor targets. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Warp is an agentic development environment.CVE-2026-48703 · Other software · warpdotdev · reported by GitHubHigh 7.8
Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution policy bypass in Agent code search tools. The affected Grep and FileGlob actions are authorized as read/search operations, but their implementations build shell command strings from Agent-controlled inputs (search text, paths, glob patterns) and execute them in the active terminal session. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
- Product
- warp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-44347 · Other software · warp-tech · reported by GitHubMedium 5.8
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kCVE-2022-26523 · Other software · reported by MITREMedium 5.3
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xbb94.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavast.comsentinelone.com
May 8, 2026The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kCVE-2022-26522 · Other software · reported by MITREHigh 7.8
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xc4a3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavast.comsentinelone.com
Apr 22, 2026ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base6CVE-2018-25269 · Other software · icewarp · reported by VulnCheckMedium 5.1
ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Attackers can craft emails containing data URIs with embedded scripts that execute in the client when the email is viewed, compromising user sessions and stealing sensitive information.
- Product
- ICEWARP Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordicewarp.comexploit-db.com
Apr 14, 2026Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally.CVE-2026-26178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026IceWarp collaboration Directory Traversal Information Disclosure Vulnerability.CVE-2026-2493 · Other software · IceWarp · reported by zdi-disclosures@trendmicro.comHigh 7.5
IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The specific flaw exists within handling of the ticket parameter provided to the collaboration endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-25440.
- Product
- IceWarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability.CVE-2025-14500 · Other software · IceWarp · reported by zdi-disclosures@trendmicro.comCritical 9.8
IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the X-File-Operation header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394.
- Product
- IceWarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability.CVE-2025-14499 · Other software · IceWarp · reported by zdi-disclosures@trendmicro.comHigh 8.8
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441.
- Product
- IceWarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.icewarp.comzerodayinitiative.com
Oct 9, 2025Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.CVE-2025-27039 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication.CVE-2025-28041 · Other software · Liaoxuefeng · reported by MITREHigh 8.6
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication.
- Product
- Itranswarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0.CVE-2025-40632 · Other software · Icewarp · reported by cve-coordination@incibe.esLow 2
Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.
- Product
- Icewarp Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0.CVE-2025-40631 · Other software · Icewarp · reported by cve-coordination@incibe.esLow 2
HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.
- Product
- Icewarp Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0.CVE-2025-40630 · Other software · Icewarp · reported by cve-coordination@incibe.esMedium 5.1
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.
- Product
- Icewarp Mail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.CVE-2025-45607 · Other software · Liaoxuefeng · reported by MITRECritical 9.8
An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.
- Product
- Itranswarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.CVE-2025-0651 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6.1
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.cloudflare.com
Jan 7, 2025IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.CVE-2024-55218 · Other software · Icewarp · reported by MITREMedium 6.1
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
- Product
- Icewarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresources.s4e.ioicewarp.com
Oct 14, 2024An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).CVE-2024-41997 · Other software · warp_terminal · reported by MITREMedium 6.6
An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the `warp://action/docker/open_subshell` intent that when clicked by the victim results in command execution on the victim's machine.
- Product
- warp_terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.warp.devdocs.warp.dev
Jan 5, 2024A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1.CVE-2024-0246 · Other software · Icewarp · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27"()%26%25<zzz><ScRiPt>alert(document.domain)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Icewarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2023Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2023-48712 · Other software · warp-tech · reported by GitHubHigh 7.1
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps.CVE-2023-43660 · Other software · warp-tech · reported by GitHubMedium 4.8
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following conditions: 1. The attacker knows the username and a valid target name 2. The attacked knows the user's public key and 3. Only SSH public key authentication is required for the user account. This issue has been addressed in version 0.8.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a craftedCVE-2023-43319 · Other software · Icewarp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
- Product
- Webclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL.CVE-2023-40779 · Other software · Icewarp · reported by MITREMedium 6.1
An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL.
- Product
- Deep Castle G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.CVE-2023-41013 · Other software · Icewarp · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
- Product
- Icewarp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.