Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 1 of 2
Aug 18, 2026CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment CVE-2026-75915 · Other software · Hmbown · reported by VulnCheckHigh 8.7
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files.CVE-2026-75914 · Other software · Hmbown · reported by VulnCheckHigh 8.7
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool.CVE-2026-75913 · Other software · Hmbown · reported by VulnCheckHigh 8.5
CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting giCVE-2026-75912 · Other software · Hmbown · reported by VulnCheckHigh 8.3
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitCVE-2026-75911 · Other software · Hmbown · reported by VulnCheckHigh 8.5
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim'CVE-2026-75859 · Other software · Hmbown · reported by VulnCheckHigh 8.7
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool.CVE-2026-75858 · Other software · Hmbown · reported by VulnCheckHigh 8.5
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprCVE-2026-75857 · Other software · Hmbown · reported by VulnCheckHigh 7.3
CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacksCVE-2026-75856 · Other software · Hmbown · reported by VulnCheckCritical 9.2
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45374 · Other software · Hmbown · reported by GitHubCritical 9.6
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45373 · Other software · Hmbown · reported by GitHubHigh 7.4
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45311 · Other software · Hmbown · reported by GitHubCritical 9.6
CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026CodeWhale is a DeepSeek + MiMo coding agent in terminal.CVE-2026-45310 · Other software · Hmbown · reported by GitHubHigh 7.4
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.
- Product
- CodeWhale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2026-28798 · Other software · IceWhaleTech · reported by GitHubCritical 9
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2026-28442 · Other software · IceWhaleTech · reported by GitHubHigh 8.5
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2026-28286 · Other software · IceWhaleTech · reported by GitHubHigh 8.5
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2025-64427 · Other software · IceWhaleTech · reported by GitHubHigh 7.1
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2026-21891 · Other software · IceWhaleTech · reported by GitHubCritical 9.4
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a known system service account. The application's login function fails to properly handle the password validation result for these users, effectively granting authenticated access to anyone who knows one of these common usernames and provides any password. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and sCVE-2025-34171 · Other software · IceWhale Tech · reported by VulnCheckMedium 6.9
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under /var/lib/casaos/1/, which reveals installed applications and configuration details. Additionally, /v1/sys/debug discloses host operating system, kernel, hardware, and storage information. The endpoints also return distinct error messages, enabling file existence enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can be used for reconnaissance and to facilitate targeted follow-up attacks against services deployed on the host.
- Product
- CasaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcasaos.zimaspace.comgithub.com
Dec 29, 2025Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.CVE-2025-69235 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.CVE-2025-69234 · Other software · NAVER · reported by cve@navercorp.comCritical 9.1
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.CVE-2025-63878 · Other software · Hackerwhale · reported by MITREMedium 6.5
Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.
- Product
- Restaurant Website Restoran
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.CVE-2025-62585 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-62584 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.CVE-2025-62583 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: SQL InjectionCVE-2025-10002 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
- Product
- ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2025ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2025-58432 · Other software · IceWhaleTech · reported by GitHubMedium 5.2
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2025-58431 · Other software · IceWhaleTech · reported by GitHubMedium 4.8
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-53600 · Other software · NAVER · reported by cve@navercorp.comHigh 7.5
Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.CVE-2025-53599 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025ClickWhale: Missing AuthorizationCVE-2025-47612 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ClickWhale ClickWhale clickwhale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickWhale: from n/a through <= 2.4.6.
- Product
- ClickWhale
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ClickWhale: Cross-Site Request Forgery (CSRF)CVE-2025-26963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a through <= 2.4.3.
- Product
- ClickWhale
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Stored Cross-Site ScriptingCVE-2025-0804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2025An issue in Cloud Whale Interactive Technology LLC.CVE-2024-56967 · Other software · reported by MITREMedium 6.5
An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Reflected Cross-Site ScriptingCVE-2024-11327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.
- Product
- ClickWhale
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings.CVE-2024-50583 · Other software · NAVER · reported by cve@navercorp.comMedium 6.3
Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings.
- Product
- Naver Whale browser Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2024-49359 · Other software · IceWhaleTech · reported by GitHubHigh 7.5
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2024-49358 · Other software · IceWhaleTech · reported by GitHubMedium 5.3
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can be exploited for username enumeration, allowing attackers to determine whether a user exists in the system or not. Attackers can leverage this information in further attacks, such as credential stuffing or targeted password brute-forcing. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2024-49357 · Other software · IceWhaleTech · reported by GitHubHigh 7.5
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2024-48932 · Other software · IceWhaleTech · reported by GitHubMedium 5.3
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.CVE-2024-48931 · Other software · IceWhaleTech · reported by GitHubHigh 7.5
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint `http://<Zima_Server_IP:PORT>/v3/file?token=<token>&files=<file_path>` is vulnerable to arbitrary file reading due to improper input validation. By manipulating the `files` parameter, authenticated users can read sensitive system files, including `/etc/shadow`, which contains password hashes for all users. This vulnerability exposes critical system data and poses a high risk for privilege escalation or system compromise. The vulnerability occurs because the API endpoint does not validate or restrict file paths provided via the `files` parameter. An attacker can exploit this by manipulating the file path to access sensitive files outside the intended directory. As of time of publication, no known patched versions are available.
- Product
- ZimaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.CVE-2024-40618 · Other software · NAVER · reported by cve@navercorp.comCritical 9.6
Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Apr 1, 2024Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS.CVE-2024-28232 · Other software · IceWhaleTech · reported by GitHubMedium 6.2
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
- Product
- CasaOS-UserService
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024CasaOS-UserService provides user management functionalities to CasaOS.CVE-2024-24766 · Other software · IceWhaleTech · reported by GitHubMedium 6.2
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
- Product
- CasaOS-UserService
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024CasaOS-UserService provides user management functionalities to CasaOS.CVE-2024-24767 · Other software · IceWhaleTech · reported by GitHubCritical 9.1
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
- Product
- CasaOS-UserService
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024CasaOS-UserService provides user management functionalities to CasaOS.CVE-2024-24765 · Other software · IceWhaleTech · reported by GitHubHigh 7.5
CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
- Product
- CasaOS-UserService
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical.CVE-2023-7226 · Other software · meetyoucrop · reported by VulDBMedium 6.3
A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads to improper ownership management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250232.
- Product
- big-whale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.CVE-2023-25632 · Other software · NAVER · reported by cve@navercorp.comMedium 5.5
The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.
- Product
- NAVER Whale browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Aug 24, 2023CasaOS is an open-source personal cloud system.CVE-2023-37469 · Other software · IceWhaleTech · reported by GitHubHigh 8.8
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.
- Product
- CasaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.