Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
61 results · page 1 of 2
Oct 15, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper Free: Deserialization of Untrusted DataCVE-2026-109686 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4.CVE-2026-110810 · Other software · ggml-org · reported by VulDBLow 0.9
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- whisper.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying craftedCVE-2026-110644 · Other software · ChetanXpro · reported by VulnCheckCritical 9.3
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
- Product
- nodejs-whisper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptiCVE-2026-110640 · Other software · ariym · reported by VulnCheckCritical 9.3
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
- Product
- whisper-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109687 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- Product
- Link Whisper Free
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026VideoWhisper Site Manager for ChatGPT, Claude, Codex: Missing AuthorizationCVE-2026-107430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
- Product
- VideoWhisper Site Manager for ChatGPT, Claude, Codex
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update VideoWhisper Site Manager for ChatGPT, Claude, Codex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Link Whisper Free: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-14601 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- Product
- Link Whisper Free
- Fixed in
- 0.9.7
- What to do
- Update Link Whisper Free to 0.9.7 or newer.
Jul 27, 2026A vulnerability was found in ggml-org whisper.cpp 95ea8f9b.CVE-2026-17513 · Other software · ggml-org · reported by VulDBLow 1.9
A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- whisper.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58.CVE-2026-17512 · Other software · ggml-org · reported by VulDBLow 1.9
A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.
- Product
- whisper.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.CVE-2026-57353 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.CVE-2026-57333 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 1, 2026A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2.CVE-2026-10298 · Other software · ggml-org · reported by VulDBLow 1.9
A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- whisper.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Link Whisper Free: Stored Cross-Site ScriptingCVE-2025-11262 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Link Whisper Free
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 7, 2026Link Whisper Free: Has a publicly accessible REST endpoint that allows unauthenticated settings updatesCVE-2026-1900 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
- Product
- Link Whisper Free
- Fixed in
- 0.9.1
- What to do
- Update Link Whisper Free to 0.9.1 or newer.
Apr 6, 2026The whisperX API is a tool for enhancing and analyzing audio content.CVE-2026-34981 · Other software · pavelzbornik · reported by GitHubMedium 5.8
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
- Product
- whisperX-FastAPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22357 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 19, 2026Whisper Money is a personal finance application.CVE-2026-23844 · Other software · whisper-money · reported by GitHubMedium 4.9
Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue.
- Product
- whisper-money
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67927 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8.
- Product
- Link Whisper Free
- Affected
- up to 0.8.8
- What to do
- Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2.CVE-2025-14569 · Other software · ggml-org · reported by VulDBLow 1.9
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- whisper.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025Link Whisper Free: Reflected Cross-Site ScriptingCVE-2025-11263 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Link Whisper Free
- Affected
- up to 0.8.8
- What to do
- Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2025Link Whisper Free: Missing AuthorizationCVE-2025-62970 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers.CVE-2025-24904 · Other software · whisperfish · reported by GitHubHigh 8.5
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and may have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.
- Product
- libsignal-service-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers.CVE-2025-24903 · Other software · whisperfish · reported by GitHubHigh 8.5
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user. The origin of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.
- Product
- libsignal-service-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Link Whisper Free: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7.
- Product
- Link Whisper Free
- Affected
- up to 0.7.7
- What to do
- Affects up to 0.7.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Link Whisper Free: Missing AuthorizationCVE-2023-32506 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3.
- Product
- Link Whisper Free
- Affected
- up to 0.6.3
- What to do
- Affects up to 0.6.3. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2024phonenumber is a library for parsing, formatting and validating international phone numbers.CVE-2024-39697 · Other software · whisperfish · reported by GitHubHigh 8.6
phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.
- Product
- rust-phonenumber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2024Link Whisper Free: Cross-Site Request Forgery (CSRF)CVE-2024-31934 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.9.
- Product
- Link Whisper Free
- Affected
- up to 0.6.9
- What to do
- Affects up to 0.6.9. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27992 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8.
- Product
- Link Whisper Free
- Affected
- up to 0.6.8
- What to do
- Affects up to 0.6.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Link Whisper Free: PHP Object InjectionCVE-2024-2693 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Link Whisper Free
- Affected
- up to 0.7.1
- What to do
- Affects up to 0.7.1. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 3, 2024VideoWhisper Live Streaming Integration: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2023-25699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
- Product
- VideoWhisper Live Streaming Integration
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 20, 2023Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47852 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
- Product
- Link Whisper Free
- Affected
- up to 0.6.5
- What to do
- Affects up to 0.6.5. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 19, 2023blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representingCVE-2023-42447 · Other software · whisperfish · reported by GitHubHigh 8.6
blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.
- Product
- blurhash-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023phonenumber is a library for parsing, formatting and validating international phone numbers.CVE-2023-42444 · Other software · whisperfish · reported by GitHubHigh 8.6
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
- Product
- rust-phonenumber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2020Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allowsCVE-2014-8338 · Other software · Videowhisper · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter.
- Product
- Webcam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
- Product
- Video Comments Webcam Recorder
- Fixed in
- 20140116
- What to do
- Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Mar 23, 2019Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograCVE-2019-9970 · Other software · Signal · reported by MITREMedium 6.5
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
- Product
- Private Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 5, 2018The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safCVE-2015-9272 · WordPress plugins & themes · reported by MITRECritical 9.8
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
- Affected
- 3.31.17 to 3.31.17
- What to do
- Affects 3.31.17 to 3.31.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comopenwall.com
Oct 4, 2018The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.phCVE-2015-9271 · WordPress plugins & themes · reported by MITRECritical 9.8
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
- Affected
- 4.91.8 to 4.91.8
- What to do
- Affects 4.91.8 to 4.91.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Aug 29, 2018The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before mCVE-2018-16132 · Other software · Signal · reported by MITREHigh 8.6
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device.
- Product
- Signal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Aug 20, 2018Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.CVE-2018-14023 · Other software · Signal · reported by MITREMedium 4
Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.
- Product
- Signal-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn0sign4l.blogspot.comyoutube.com
Jun 6, 2018whispercast is a file server.CVE-2017-16174 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
- Product
- whispercast node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 17, 2018Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leadinCVE-2018-11101 · Other software · Signal · reported by MITREMedium 6.1
Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> and then replying to it. The included JavaScript code is then executed automatically, with
- Product
- Signal-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 14, 2018js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.CVE-2018-10994 · Other software · Signal · reported by MITREMedium 6.1
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
- Product
- Signal-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2018The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actioCVE-2018-9840 · Other software · Signal · reported by MITREMedium 6.8
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
- Product
- Signal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2018Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject CVE-2014-2297 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4.
- Product
- VideoWhisper Live Streaming Integration
- Affected
- 4.29.6 to 4.29.6
- What to do
- Affects 4.29.6 to 4.29.6. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 29, 2014The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4CVE-2014-1908 · WordPress plugins & themes · reported by MITREMedium 5
The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
- Fixed in
- 4.29.5
- What to do
- Update the plugin to 4.29.5 or newer.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Dec 29, 2014Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote atCVE-2014-1905 · WordPress plugins & themes · reported by MITREHigh 10
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
- Product
- Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration
- Fixed in
- 4.29.5
- What to do
- Update Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration to 4.29.5 or newer.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Sep 9, 2014The Whisper (aka sh.whisper) application 4.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spooCVE-2014-5808 · Other software · Whisper · reported by cret@cert.orgMedium 5.4
The Whisper (aka sh.whisper) application 4.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Whisper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.