Vulnerability database

7 results

• Aug 11, 2026Metabase SQL Injection VulnerabilityCVE-2026-72898 · Other software · Metabase · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedCritical 10

  Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

  Product

  Metabase

  On CISA’s list since

  Aug 11, 2026 (federal fix deadline Aug 14, 2026)

  What to do

  Attackers are using this now. Install Metabase’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comraw.githubusercontent.com

• Jul 21, 2026WordPress Core Interpretation Conflict VulnerabilityCVE-2026-63030 · WordPress plugins & themes · reported by WPScanExploitedCritical 9.8

  WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

  Product

  Core

  Fixed in

  6.9.5

  On CISA’s list since

  Jul 21, 2026 (federal fix deadline Jul 24, 2026)

  What to do

  Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comwordpress.org

• Dec 5, 2025Meta React Server Components Remote Code Execution VulnerabilityCVE-2025-55182 · Other software · Meta · reported by cve-assign@fb.comExploitedRansomwareCritical 10

  Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

  Product

  React Server Components

  On CISA’s list since

  Dec 5, 2025 (federal fix deadline Dec 12, 2025)

  What to do

  Attackers are using this now. Install Meta’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogreact.devfacebook.com

• Sep 2, 2025Meta Platforms WhatsApp Incorrect Authorization VulnerabilityCVE-2025-55177 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedMedium 5.4

  Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

  Product

  WhatsApp

  On CISA’s list since

  Sep 2, 2025 (federal fix deadline Sep 23, 2025)

  What to do

  Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogfacebook.comwhatsapp.com

• Nov 12, 2024Metabase GeoJSON API Local File Inclusion VulnerabilityCVE-2021-41277 · Other software · Metabase · reported by GitHubExploitedCritical 10

  Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

  Product

  Metabase

  On CISA’s list since

  Nov 12, 2024 (federal fix deadline Dec 3, 2024)

  What to do

  Attackers are using this now. Install Metabase’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• May 23, 2022WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2

  A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

  Product

  WhatsApp

  On CISA’s list since

  May 23, 2022 (federal fix deadline Jun 13, 2022)

  What to do

  Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comfacebook.com

• Apr 19, 2022WhatsApp VOIP Stack Buffer Overflow VulnerabilityCVE-2019-3568 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedCritical 9.8

  A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.

  Product

  WhatsApp

  On CISA’s list since

  Apr 19, 2022 (federal fix deadline May 10, 2022)

  What to do

  Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comfacebook.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.