Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25875 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25814 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25813 · Other software · Praskla-Technology · reported by GitHubHigh 8.7
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25812 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25811 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25876 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25810 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25809 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25806 · Other software · Praskla-Technology · reported by GitHubMedium 5.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026PlaciPy is a placement management system designed for educational institutions.CVE-2026-25753 · Other software · Praskla-Technology · reported by GitHubCritical 9.3
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.
- Product
- assessment-placipy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.