Updated 37 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

35 results

Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer ovCVE-2026-25823 · Other software · reported by MITRECritical 9.8
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hmsnetworks.blob.core.windows.net hms-networks.com
Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticatedCVE-2026-25819 · Other software · reported by MITREHigh 7.5
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hmsnetworks.blob.core.windows.net hms-networks.com
Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for CVE-2026-25818 · Other software · reported by MITRECritical 9.1
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hmsnetworks.blob.core.windows.net hms-networks.com
Mar 13, 2026HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutraliCVE-2026-25817 · Other software · reported by MITREHigh 8.8
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hmsnetworks.blob.core.windows.net hms-networks.com
Mar 11, 2026eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user dataCVE-2019-25470 · Other software · eWON · reported by VulnCheckHigh 8.7
eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with minimal privileges to retrieve sensitive user data by exploiting the wsdReadForm endpoint. Attackers can send POST requests to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter to extract encrypted passwords for all users, which can be decrypted using a hardcoded XOR key.
Product
eWON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz exploit-db.com
Jan 28, 2025EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.CVE-2025-0432 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govMedium 6.9
EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.
Product
Ewon Flexy 202
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hmsnetworks.blob.core.windows.net support.hms-networks.com
Dec 19, 2024A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device.CVE-2024-9154 · Other software · HMS Networks · reported by office@cyberdanube.comHigh 8.6
A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633).
Product
Ewon Flexy 205
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cyberdanube.com seclists.org
Oct 17, 2024The EWON FLEXY 202 transmits credentials using a weak encoding method base64.CVE-2024-7755 · Other software · HMS Networks · reported by ics-cert@hq.dhs.govHigh 7.1
The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.
Product
EWON FLEXY 202
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Aug 6, 2024A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issuCVE-2024-33897 · Other software · hms-networks · reported by MITRECritical 9.1
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
Product
ewon_cosy_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting.CVE-2024-33896 · Other software · Hms-networks · reported by MITREHigh 7.2
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3.
Product
Ewon Cosy+ Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters.CVE-2024-33895 · Other software · Hms-networks · reported by MITREMedium 6.6
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in version 21.2s10 and 22.1s3, the key is now unique per device.
Product
Ewon Cosy+ Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 2, 2024Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elCVE-2024-33894 · Other software · hms-networks · reported by MITREHigh 8.8
Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges.
Product
ewon_cosy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 2, 2024Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitizCVE-2024-33893 · Other software · Hms-networks · reported by MITREMedium 6.1
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitization. This is fixed in version 21.2s10 and 22.1s3.
Product
Ewon Cosy+ Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Aug 2, 2024Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking informationCVE-2024-33892 · Other software · hms-networks · reported by MITREHigh 7.5
Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3
Product
ewon_cosy_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.syss.com hmsnetworks.blob.core.windows.net
Oct 4, 2023IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting.CVE-2023-40684 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.6
IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019.
Product
Content Navigator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com https
Jul 9, 2021In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure,CVE-2021-33214 · Other software · Hms-networks · reported by MITREMedium 6.1
In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.
Product
Ecatcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.hms-networks.com labs.bishopfox.com
Jan 26, 2021SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.CVE-2021-3165 · Other software · Missionlabs · reported by MITREHigh 8.8
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
Product
Smartagent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record orionhridoy.me packetstormsecurity.com
Sep 18, 2020All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources.CVE-2020-16230 · Other software · Hms-networks · reported by ics-cert@hq.dhs.govLow 2.3
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.
Product
Ewon Flexy Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Apr 7, 2020A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0).CVE-2020-10633 · Other software · Hms-networks · reported by ics-cert@hq.dhs.govMedium 6.1
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
Product
Ewon Flexy Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Oct 1, 2019IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks against the system.CVE-2019-4246 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks against the system. IBM X-Force ID: 159521.
Product
Daeja ViewONE Virtual
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 30, 2019IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2019-4456 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 163620.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jul 2, 2019IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download server files resulting in sensitive informatioCVE-2019-4260 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download server files resulting in sensitive information disclosure. IBM X-Force ID: 160012.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Nov 2, 2018IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.CVE-2018-1835 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150514.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Feb 27, 2018IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting.CVE-2018-1399 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138435.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file.CVE-2017-1212 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file. IBM X-Force ID: 123852.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled.CVE-2017-1211 · Other software · IBM · reported by psirt@us.ibm.comLow 2.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled. IBM X-Force ID: 123851.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimaCVE-2017-1210 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Oct 24, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting.CVE-2017-1209 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123849.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Jul 13, 2017IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due toCVE-2017-1308 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462.
Product
Daeja ViewONE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com securityfocus.com
Dec 23, 2015eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) weCVE-2015-7929 · Other software · Ewon · reported by ics-cert@hq.dhs.govMedium 4.3
eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz packetstormsecurity.com
Dec 23, 2015eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain acCVE-2015-7928 · Other software · Ewon · reported by ics-cert@hq.dhs.govHigh 8.5
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz packetstormsecurity.com
Dec 23, 2015Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspeciCVE-2015-7927 · Other software · Ewon · reported by ics-cert@hq.dhs.govMedium 6.1
Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz packetstormsecurity.com
Dec 23, 2015eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive informationCVE-2015-7926 · Other software · Ewon · reported by ics-cert@hq.dhs.govCritical 9.9
eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz packetstormsecurity.com
Dec 23, 2015Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administratCVE-2015-7925 · Other software · Ewon · reported by ics-cert@hq.dhs.govHigh 8
Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz packetstormsecurity.com
Dec 23, 2015eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remoteCVE-2015-7924 · Other software · Ewon · reported by ics-cert@hq.dhs.govHigh 8.8
eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Product
Ewon Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ewon.biz seclists.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.