Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Oct 19, 2026MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.CVE-2026-112161 · Other software · Mobatek · reported by cve-coordination@incibe.esHigh 8.5
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
- Product
- MobaXterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directorCVE-2026-11967 · Other software · Mobatek · reported by cve-coordination@incibe.esHigh 8.5
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library from that location during startup, an attacker with local access can place a specially crafted DLL alongside the executable to be executed when the victim launches the application.
- Product
- MobaXterm Personal Edition (Portable)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory thCVE-2026-11879 · Other software · Mobatek · reported by cve-coordination@incibe.esHigh 8.5
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory that is predictable and can be modified by the user. During startup, the application searches for specific DLLs in this location before resorting to the system’s secure paths, enabling an attacker with local access to place a specially crafted DLL to be executed automatically when the victim launches the application.
- Product
- MobaXterm Personal Edition (Portable)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows remCVE-2019-25741 · Other software · Mobatek · reported by VulnCheckCritical 9.3
Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the vulnerability when imported and executed, enabling reverse shell execution with user privileges.
- Product
- Mobatek MobaXterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.mobatek.netexploit-db.com
Apr 17, 2026A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1.CVE-2026-6421 · Other software · Mobatek · reported by VulDBMedium 6.4
A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- MobaXterm Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.mobatek.netdrive.google.com
Mar 9, 2026MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability.CVE-2026-25866 · Other software · Mobatek · reported by VulnCheckHigh 8.5
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.
- Product
- MobaXterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmobaxterm.mobatek.netvulncheck.com
Feb 17, 2025The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0.CVE-2025-0714 · Other software · Mobatek · reported by a341c0d1-ebf7-493f-a84e-38cf86618674Medium 6.5
The vulnerability exists in the password storage of Mobateks MobaXterm in versions below 25.0. MobaXTerm uses an initialisation vector (IV) consisting only of zero bytes and a master key to encrypt each password individually. In the default configuration, on opening MobaXTerm, the user is prompted for their password. A derivative of the password is used as the master key. As both the master key and the IV are the same for each stored password, the AES CFB ciphertext depends only on the plaintext (the password). The static IV and master key make it easier to obtain sensitive information and to decrypt data when it is stored at rest.
- Product
- MobaXterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning oCVE-2024-48200 · Other software · mobatek · reported by MITREHigh 8.4
An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning one Administrative cmd (conhost.exe)
- Product
- mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commobaxterm.mobatek.net
Dec 5, 2022When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server.CVE-2022-38337 · Other software · Mobatek · reported by MITRECritical 9.1
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.ssh-mitm.atmobaxterm.mobatek.net
Dec 5, 2022An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.CVE-2022-38336 · Other software · Mobatek · reported by MITREHigh 8.1
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.ssh-mitm.atdocs.ssh-mitm.at
Jun 3, 2021MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speedCVE-2021-28847 · Other software · Mobatek · reported by MITREHigh 7.5
MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmobaxterm.mobatek.netmobaxterm.mobatek.net
Sep 14, 2019In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.CVE-2019-16305 · Other software · Mobatek · reported by MITREHigh 8.8
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command execution is achieved, as demonstrated by the MobaXterm://`calc` URI.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreetom.github.iofreetom.github.io
Jul 9, 2019In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user vCVE-2019-13475 · Other software · Mobatek · reported by MITREHigh 8.8
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
May 13, 2019In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the procesCVE-2019-7690 · Other software · Mobatek · reported by MITRECritical 9.8
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2017The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23.CVE-2017-15376 · Other software · Mobatek · reported by MITRECritical 9.8
The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Mar 20, 2017Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a ..CVE-2017-6805 · Other software · Mobatek · reported by MITREMedium 5.3
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET command.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgpacketstormsecurity.com
Nov 3, 2015The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 cCVE-2015-7244 · Other software · Mobatek · reported by cret@cert.orgHigh 7.5
The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
- Product
- Mobaxterm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mobatek.netkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.