Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Oct 15, 2026BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parseCVE-2026-111363 · Other software · dataelement · reported by VulnCheckHigh 7.1
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
- Product
- bisheng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.CVE-2026-51861 · Other software · reported by MITRECritical 9.8
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 30, 2026bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.CVE-2026-51860 · Other software · reported by MITREHigh 7.5
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 30, 2026bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).CVE-2026-51859 · Other software · reported by MITRECritical 9.1
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 28, 2026bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication CVE-2026-82285 · Other software · dataelement · reported by VulnCheckHigh 8.8
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
- Product
- bisheng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary PythoCVE-2026-82278 · Other software · dataelement · reported by VulnCheckHigh 8.7
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.
- Product
- bisheng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023There is a misinterpretation of input vulnerability in Huawei Printer.CVE-2022-48473 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- Product
- BiSheng-WNM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023A Huawei printer has a system command injection vulnerability.CVE-2022-48472 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
- Product
- BiSheng-WNM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023There is a misinterpretation of input vulnerability in Huawei Printer.CVE-2022-48471 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- Product
- BiSheng-WNM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.CVE-2022-48261 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
- Product
- Bisheng-wnm Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325.CVE-2022-48260 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to device service exceptions.
- Product
- Bisheng-wnm Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325.CVE-2022-48259 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.
- Product
- Bisheng-wnm Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325.CVE-2022-48255 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.
- Product
- Bisheng-wnm Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.CVE-2022-48230 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS.
- Product
- Bisheng-wnm Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.