Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Sep 1, 2025TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") onCVE-2025-9810 · Other software · antirez · reported by 96148269-fe82-4198-b1bf-3a73ce8bc92eMedium 6.8
TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.
- Product
- linenoise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025hostapd fails to process crafted RADIUS packets properly.CVE-2025-24912 · Other software · Jouni Malinen · reported by vultures@jpcert.or.jpLow 3.7
hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.
- Product
- hostapd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/CVE-2024-45933 · Other software · online_news_portal_project · reported by MITREMedium 6.6
OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint.
- Product
- online_news_portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2024Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password.CVE-2024-45522 · Other software · linen · reported by MITRECritical 9.8
Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts.
- Product
- linen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via add_lineno_map_item at src/mjs_bcode.c.CVE-2021-46548 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via add_lineno_map_item at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.CVE-2021-46481 · Other software · Jsish · reported by MITREMedium 5.5
Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c.
- Product
- Jsish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2018Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.CVE-2018-10316 · Other software · Nasm · reported by MITREMedium 5.5
Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the assemble_file function of asm/nasm.c because of a globallineno integer overflow.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 10, 2016linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reaCVE-2013-7458 · Other software · Redislabs · reported by security@debian.orgLow 3.3
linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 21, 2010SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers to execute arbitrary SQL commands via tCVE-2010-2342 · Other software · Dmxready · reported by MITREHigh 7.5
SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
- Product
- Online Notebook Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Apr 21, 2009Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a lonCVE-2009-1351 · Other software · Heikki Ylinen · reported by MITREHigh 9.3
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.