Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 14, 2026Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded travCVE-2026-110766 · Other software · colanode · reported by VulnCheckMedium 5.3
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.
- Product
- colanode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbCVE-2026-100520 · Other software · crivion · reported by VulnCheckHigh 8.7
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
- Product
- Laranode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validatCVE-2026-24014 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
- Product
- Apache IoTDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 23, 2025In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.CVE-2025-48753 · Other software · obsidiandynamics · reported by MITRELow 2.9
In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.
- Product
- anode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata.CVE-2021-41532 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
- Product
- Apache Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.commail-archives.apache.org
Nov 19, 2021In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token.CVE-2021-39235 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
- Product
- Apache Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.commail-archives.apache.org
Nov 19, 2021In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.CVE-2021-39233 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
- Product
- Apache Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.commail-archives.apache.org
Apr 26, 2017HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace.CVE-2017-3162 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
- Product
- Apache Hadoop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlists.apache.org
Jul 12, 2012DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twCVE-2012-3376 · Websites & servers · Apache · reported by Red HatHigh 7.5
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
- Product
- Hadoop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Jun 24, 2010Integer overflow in the nsGenericDOMDataNode::SetTextInternal function in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, CVE-2010-1196 · Computers, phones & browsers · Mozilla · reported by MITREHigh 9.3
Integer overflow in the nsGenericDOMDataNode::SetTextInternal function in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a DOM node with a long text value that triggers a heap-based buffer overflow.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jul 5, 2007Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to eCVE-2006-7217 · Websites & servers · Apache · reported by MITREMedium 4
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
- Product
- Derby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddb.apache.orgissues.apache.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.