Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Mar 19, 2026OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information.CVE-2026-32869 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.1
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim's session when they visit the case information page.
- Product
- eComplaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Mar 19, 2026OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen.CVE-2026-32868 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.1
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim's session.
- Product
- eComplaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Mar 19, 2026OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile.CVE-2026-32866 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.1
OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The attacker can run script in the context of a victim's session.
- Product
- eCASE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Mar 19, 2026OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePassworCVE-2026-32865 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.
- Product
- eComplaint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Mar 11, 2026An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: CVE-2026-1524 · Other software · neo4j · reported by 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6Low 2.1
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities. We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.
- Product
- Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable valuesCVE-2026-22234 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
- Product
- eCase Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field.CVE-2026-22233 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits the Project Cost tab. Fixed in OPEXUS eCASE Audit 11.14.2.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality.CVE-2026-22232 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality.CVE-2026-22231 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user views the Action History Log. Fixed in OPEXUS eCASE Platform 11.14.1.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Jan 8, 2026OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disablCVE-2026-22230 · Other software · OPEXUS · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0.
- Product
- eCASE Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opexustech.comraw.githubusercontent.com
Oct 9, 2025Memory corruption during PlayReady APP usecase while processing TA commands.CVE-2025-27053 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption during PlayReady APP usecase while processing TA commands.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure while running video usecase having rogue firmware.CVE-2025-27033 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure while running video usecase having rogue firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times aCVE-2023-28448 · Other software · firecracker-microvm · reported by GitHubMedium 5.7
Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.
- Product
- versionize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DCVE-2022-28128 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DCVE-2022-25348 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, NicCVE-2019-14024 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130
- Product
- Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 7, 2018Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC CVE-2018-0660 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpLow 3.3
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially CVE-2018-0659 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpMedium 5.5
Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially crafted ATC file.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.CVE-2018-0675 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.CVE-2018-0674 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to gain privileges via CVE-2017-2272 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Self-extracting encrypted files created by AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to gain privileges via CVE-2017-2271 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Self-extracting encrypted files created by AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2017Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remCVE-2016-7843 · Other software · MaruUo Factory · reported by vultures@jpcert.or.jpMedium 5.5
Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
- Product
- AttacheCase for Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmaruuofactory.life.coocan.jp
Apr 28, 2017Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially craftCVE-2016-7842 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpMedium 5.5
Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Dec 30, 2010Untrusted search path vulnerability in AttacheCase before 2.70 allows local users to gain privileges via a Trojan horse executable file in the current working dCVE-2010-3923 · Other software · Mitsu Hiro HI Rose · reported by vultures@jpcert.or.jpMedium 6.9
Untrusted search path vulnerability in AttacheCase before 2.70 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
- Product
- Attachecase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhomepage2.nifty.comjvn.jp
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.