Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Oct 14, 2026OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTECVE-2026-110260 · Other software · OW2 · reported by VulnCheckMedium 6.8
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
- Product
- ASM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasm.ow2.iogitlab.ow2.org
Sep 21, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-61612 · Other software · ondata · reported by GitHubMedium 5.7
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied `server_url` whose hostname *resolves* to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (`169.254.169.254`). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-53509 · Other software · ondata · reported by GitHubMedium 5.7
CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-73846 · Other software · ondata · reported by GitHubMedium 6.5
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-73845 · Other software · ondata · reported by GitHubMedium 5.3
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-73844 · Other software · ondata · reported by GitHubLow 3.7
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2026-42032 · Other software · ckan · reported by GitHubMedium 6.7
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2026-42031 · Other software · ckan · reported by GitHubHigh 8.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed in 2.10.10 and 2.11.5.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2026-41255 · Other software · ckan · reported by GitHubMedium 6.1
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2026-41132 · Other software · ckan · reported by GitHubMedium 6.6
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026CKAN MCP Server is a tool for querying CKAN open data portals.CVE-2026-33060 · Other software · ondata · reported by GitHubMedium 5.3
CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services. There is no URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces. An attack can lead to internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter. This issue has been fixed in version 0.4.85.
- Product
- ckan-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-64100 · Other software · ckan · reported by GitHubMedium 6.1
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-54384 · Other software · ckan · reported by GitHubMedium 6.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-24372 · Other software · ckan · reported by GitHubHigh 7.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none`
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.ckan.orgdocs.ckan.org
Aug 21, 2024CKAN is an open-source data management system for powering data hubs and data portals.CVE-2024-43371 · Other software · ckan · reported by GitHubMedium 4.5
CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024CKAN is an open-source data management system for powering data hubs and data portals.CVE-2024-41675 · Other software · ckan · reported by GitHubMedium 6.8
CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024CKAN is an open-source data management system for powering data hubs and data portals.CVE-2024-41674 · Other software · ckan · reported by GitHubMedium 5.3
CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log.CVE-2024-27097 · Other software · ckan · reported by GitHubMedium 4.3
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023CKAN is an open-source data management system for powering data hubs and data portals.CVE-2023-50248 · Other software · ckan · reported by GitHubMedium 4.5
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023CKAN is an open-source data management system for powering data hubs and data portals.CVE-2023-32696 · Other software · ckan · reported by GitHubHigh 8.8
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.
- Product
- ckan-docker-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023CKAN is an open-source data management system for powering data hubs and data portals.CVE-2023-32321 · Other software · ckan · reported by GitHubCritical 9.8
CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have b
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2023-22746 · Other software · ckan · reported by GitHubHigh 8.6
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images).
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.CVE-2022-43685 · Other software · Okfn · reported by MITREHigh 8.8
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
- Product
- Ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture.CVE-2021-25967 · Other software · ckan · reported by vulnerabilitylab@mend.ioMedium 5.4
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
May 30, 2018tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file.CVE-2018-11556 · Other software · Littlecms · reported by MITREHigh 7.8
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”
- Product
- Little CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2010SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.CVE-2010-0691 · Other software · Jtl-software · reported by MITREHigh 7.5
SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.
- Product
- Jtl-shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2009Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitrary web script or HTML via the tablenameCVE-2008-5893 · Other software · Icash · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitrary web script or HTML via the tablename parameter in an update action.
- Product
- Click&email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jan 12, 2009Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1) the ID parameter to admin_dblayers.asp CVE-2008-5892 · Other software · Icash · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1) the ID parameter to admin_dblayers.asp in an update action, (2) the adminid parameter to admin_loginCheck.asp (aka the USERNAME field in admin_main.asp), and (3) the PassWord parameter to admin_loginCheck.asp (aka the PASSWORD field in admin_main.asp). NOTE: some of these details are obtained from third party information.
- Product
- Click&email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.