Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Oct 16, 2026Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.CVE-2026-111823 · Other software · Mage · reported by MITRECritical 9.8
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Mage AI does not confine the paths accepted by its browser-items API to the project directory.CVE-2026-81030 · Other software · mage-ai · reported by VulnCheckHigh 7.1
Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling FileContentResource and FileResource classes both use, so the resource contains no such call while those two contain several. A user holding the Viewer role, which grants read access within the project and nothing outside it, can therefore read any file the server process can read by supplying an absolute path. The permission model that would otherwise separate roles is not consulted for this route in the default configuration, because the setting that enables it defaults to false. Callers holding the Editor role additionally write through the same unconfined path, though that role is already able to execute code by design, so the boundary crossed by this flaw is the read available to the Viewer role.
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" requestCVE-2024-45190 · Other software · mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" requestCVE-2024-45189 · Other software · Mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request
- Product
- Mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" requestCVE-2024-45188 · Other software · mage · reported by reefs@jfrog.comMedium 6.5
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access CVE-2024-45187 · Other software · mage · reported by reefs@jfrog.comHigh 7.1
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary usersCVE-2024-8072 · Other software · mage · reported by reefs@jfrog.comMedium 5.3
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023mage-ai is an open-source data pipeline tool for transforming and integrating data.CVE-2023-31143 · Other software · mage-ai · reported by GitHubMedium 5.9
mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.
- Product
- mage-ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.