Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
35 results
Sep 27, 2026spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt.CVE-2026-100867 · Other software · spaceship-prompt · reported by VulnCheckMedium 4.8
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.
- Product
- spaceship-prompt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Oh My Zsh is a community-driven framework for managing Zsh configuration.CVE-2026-50187 · Other software · ohmyzsh · reported by GitHubHigh 8.8
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.
- Product
- ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Liquid Prompt is an adaptive prompt for Bash and Zsh.CVE-2026-27113 · Other software · liquidprompt · reported by GitHubMedium 6.3
Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c on the master branch, arbitrary command injection can lead to code execution when a user enters a directory in a Git repository containing a crafted branch name. Exploitation requires the LP_ENABLE_GITSTATUSD config option to be enabled (enabled by default), gitstatusd to be installed and started before Liquid Prompt is loaded (not the default), and shell prompt substitution to be active (enabled by default in Bash via "shopt -s promptvars", not enabled by default in Zsh). A branch name containing shell syntax such as "$(...)" or backtick expressions in the default branch or a checked-out branch will be evaluated by the shell when the prompt is rendered. No stable release is affected; only the master branch contains the vulnerable commit. Commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c contains a fix. As a workaround, set the LP_ENABLE_GITSTATUSD config option to 0.
- Product
- liquidprompt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026gradle-completion provides Bash and Zsh completion support for Gradle.CVE-2026-25063 · Other software · gradle · reported by GitHubHigh 8.3
gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3.0 that allows arbitrary code execution when a user triggers Bash tab completion in a project containing a malicious Gradle build file. The `gradle-completion` script for Bash fails to adequately sanitize Gradle task names and task descriptions, allowing command injection via a malicious Gradle build file when the user completes a command in Bash (without them explicitly running any task in the build). For example, given a task description that includes a string between backticks, then that string would be evaluated as a command when presenting the task description in the completion list. While task execution is the core feature of Gradle, this inherent execution may lead to unexpected outcomes. The vulnerability does not affect zsh completion. The first patched version is 9.3.1. As a workaround, it is possible and effective to temporarily disable bash completion for Gradle by removing `gradle-completion` from `.bashrc` or `.bash_profile`.
- Product
- gradle-completion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WizShop: Path Traversal: '.../...//'CVE-2025-25122 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.
- Product
- WizShop
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update WizShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument.CVE-2021-45444 · Other software · ZSH · reported by MITREHigh 7.8
In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Nov 30, 2021# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them CVE-2021-3769 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn resCVE-2021-3727 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-suppCVE-2021-3726 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, useCVE-2021-3725 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS CommandCVE-2021-3934 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user intCVE-2020-11073 · Other software · MichaelAquilina · reported by GitHubHigh 7.9
In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
- Product
- zsh-autoswitch-virtualenv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2020In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option.CVE-2019-20044 · Other software · ZSH · reported by MITREHigh 7.8
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 5, 2018An issue was discovered in zsh before 5.6.CVE-2018-13259 · Other software · Canonical · reported by security@debian.orgCritical 9.8
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.debian.org
Sep 5, 2018An issue was discovered in zsh before 5.6.CVE-2018-0502 · Other software · Canonical · reported by security@debian.orgCritical 9.8
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.debian.org
Apr 11, 2018zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function.CVE-2018-1100 · Other software · zsh · reported by Red HatHigh 7.8
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.
- Product
- zsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 28, 2018Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality.CVE-2018-1083 · Other software · zsh · reported by Red HatHigh 7.8
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
- Product
- zsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Mar 9, 2018zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function.CVE-2018-1071 · Other software · zsh · reported by Red HatMedium 5.5
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
- Product
- zsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Feb 27, 2018In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.CVE-2018-7549 · Other software · ZSH · reported by MITREHigh 7.5
In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsecurity.gentoo.org
Feb 27, 2018In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.CVE-2018-7548 · Other software · ZSH · reported by MITRECritical 9.8
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsourceforge.net
Feb 27, 2018In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.CVE-2017-18206 · Other software · ZSH · reported by MITRECritical 9.8
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 27, 2018In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if CVE-2017-18205 · Other software · ZSH Project · reported by MITREHigh 8.1
In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsecurity.gentoo.org
Feb 27, 2018In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.CVE-2016-10714 · Other software · ZSH · reported by MITRECritical 9.8
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netusn.ubuntu.com
Feb 27, 2018In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.CVE-2014-10072 · Other software · ZSH Project · reported by MITRECritical 9.8
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 27, 2018In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.CVE-2014-10071 · Other software · ZSH · reported by MITRECritical 9.8
In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comsourceforge.net
Feb 27, 2018zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers).CVE-2014-10070 · Other software · ZSH Project · reported by MITREHigh 7.8
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzsh.sourceforge.netsourceforge.net
May 20, 2015platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remoteCVE-2015-1262 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comlists.opensuse.org
Dec 3, 2007Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.CVE-2007-6209 · Other software · ZSH · reported by MITREMedium 4.6
Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- Product
- ZSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2007Cross-site scripting (XSS) vulnerability in auth.php in Pineapple Technologies QuizShock 1.6.1 and earlier allows remote attackers to inject arbitrary web scripCVE-2007-1905 · Other software · Pineapple Technologies · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in auth.php in Pineapple Technologies QuizShock 1.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via encoded special characters in the forward_to parameter, as demonstrated using "<"<".
- Product
- Quizshock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comjohn-martinelli.com
Dec 29, 2005Cross-site scripting (XSS) vulnerability in myEZshop Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.CVE-2005-4571 · Other software · Myezshop · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in myEZshop Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Myezshop Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2005Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) GroupsId and (2) ItemsId pCVE-2005-4572 · Other software · Myezshop · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) GroupsId and (2) ItemsId parameters in admin.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Myezshop Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2003Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare allows remote attackers to cause a deniaCVE-2003-1339 · Other software · Ezmeeting · reported by MITREHigh 10
Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare allows remote attackers to cause a denial of service (crash) or execute arbitrary code, as demonstrated via (1) a long GET request and (2) a long operation or autologin parameter to SwEzModule.dll.
- Product
- Ezmeeting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2001loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a "/" in front of CVE-2000-1092 · Other software · Alex Heiphetz Group · reported by MITREMedium 5
loadpage.cgi CGI program in EZshopper 3.0 and 2.0 allows remote attackers to list and read files in the EZshopper data directory by inserting a "/" in front of the target filename in the "file" parameter.
- Product
- Ezshopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
Feb 27, 2000EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a ..CVE-2000-0187 · Other software · Alex Heiphetz Group · reported by MITREHigh 7.5
EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.
- Product
- Ezshopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Feb 27, 2000EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a ..CVE-2000-0188 · Other software · Alex Heiphetz Group · reported by MITREHigh 7.5
EZShopper 3.0 search.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execute commands via shell metacharacters.
- Product
- Ezshopper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.