Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Sep 1, 2026A vulnerability was found in Cleo Harmony up to 5.8.1.10.CVE-2026-84115 · Other software · Cleo · reported by VulDBMedium 5.5
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.cleo.comvuldb.com
Sep 1, 2026A vulnerability has been found in Cleo Harmony up to 5.8.1.10.CVE-2026-84114 · Other software · Cleo · reported by VulDBLow 2.1
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.cleo.comvuldb.com
Oct 16, 2025A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10.CVE-2025-11864 · Other software · NucleoidAI · reported by VulDBMedium 6.9
A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply of the file /src/cluster.ts of the component Outbound Request Handler. Such manipulation of the argument https/ip/port/path/headers leads to server-side request forgery. The attack may be performed from remote.
- Product
- Nucleoid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- Product
- Multiple Products
- On CISA’s list since
- Dec 17, 2024 (federal fix deadline Jan 7, 2025)
- What to do
- Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.cleo.comsupport.cleo.com
Oct 27, 2024Cleo Multiple Products Unrestricted File Upload VulnerabilityCVE-2024-50623 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
- Product
- Multiple Products
- On CISA’s list since
- Dec 13, 2024 (federal fix deadline Jan 3, 2025)
- What to do
- Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.cleo.comcisa.gov
Nov 9, 2022An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to theCVE-2022-42966 · Other software · cleo · reported by reefs@jfrog.comMedium 5.9
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
- Product
- cleo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 18, 2021An issue was discovered in Cleo LexiCom 5.5.0.0.CVE-2021-33577 · Other software · Cleo · reported by MITREMedium 5.3
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
- Product
- Lexicom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021An issue was discovered in Cleo LexiCom 5.5.0.0.CVE-2021-33576 · Other software · Cleo · reported by MITRECritical 9.8
An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
- Product
- Lexicom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2014The CLEO Malaysia (aka com.magzter.cleomalaysia) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middlCVE-2014-7414 · Other software · Magzter · reported by cret@cert.orgMedium 5.4
The CLEO Malaysia (aka com.magzter.cleomalaysia) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cleo Malaysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 17, 2003Buffer overflow in the (1) oracle and (2) oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code viaCVE-2003-0894 · Other software · Oracle · reported by MITREMedium 4.6
Buffer overflow in the (1) oracle and (2) oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument.
- Product
- Oracle9i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordotn.oracle.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.