Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Jul 15, 2026Dashy is a self-hostable personal dashboard.CVE-2026-54443 · Other software · lissy93 · reported by GitHubMedium 5.9
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.
- Product
- dashy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Repomix is a tool that packs repositories into AI-friendly files.CVE-2026-49988 · Other software · yamadashy · reported by GitHubMedium 6.8
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.
- Product
- repomix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Repomix is a tool that packs repositories into AI-friendly files.CVE-2026-49987 · Other software · yamadashy · reported by GitHubHigh 7.5
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.
- Product
- repomix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Dashy is a self-hostable personal dashboard.CVE-2026-46485 · Other software · lissy93 · reported by GitHubHigh 8.2
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.
- Product
- dashy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Dashy is a self-hostable personal dashboard.CVE-2026-55592 · Other software · lissy93 · reported by GitHubLow 3.9
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
- Product
- dashy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1.CVE-2023-5916 · Other software · Lissy93 · reported by VulDBMedium 4.3
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-244305 was assigned to this vulnerability.
- Product
- Dashy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtreasure-blarney-085.notion.site
Jul 27, 2023Sails is a realtime MVC Framework for Node.js.CVE-2023-38504 · Other software · balderdashy · reported by GitHubHigh 7.5
Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.
- Product
- sails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.