Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Oct 12, 2026The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.CVE-2026-89111 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 10
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
- Product
- SAP Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality.CVE-2026-107104 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint.CVE-2026-107103 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint.CVE-2026-107102 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory.CVE-2026-84149 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.2
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint.CVE-2026-84148 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.2
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.CVE-2026-84147 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 10
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code and compromise the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Velociraptor allows multi-tenant deployments named "Orgs".CVE-2026-18860 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.7
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.velociraptor.appgithub.com
Aug 6, 2026In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly.CVE-2025-14561 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Critical 9
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Jul 29, 2026A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive daCVE-2026-63239 · Other software · Three Learning · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 5.4
A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.
- Product
- Koollab LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants.CVE-2025-13475 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Low 3.5
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
May 19, 2026Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.CVE-2026-31388 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 24, 2026In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as anCVE-2025-59308 · Other software · reported by MITREMedium 4.7
In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoofCVE-2024-7209 · Other software · NetWin · reported by cret@cert.orgMedium 6.5
A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoof the email identify of the sender.
- Product
- NetWin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jul 30, 2024A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided CVE-2024-7208 · Other software · HostGator · reported by cret@cert.orgMedium 6.5
A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC (or SPF or DKIM) policies.
- Product
- HostGator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jan 29, 2024In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may CVE-2023-22836 · Other software · Palantir · reported by cve-coordination@palantir.comLow 3.5
In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, the renamed value may be visible to the rest of the stack’s tenants.
- Product
- com.palantir.skywise:guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Sep 27, 2023A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to acceCVE-2023-20254 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.2
A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled. This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.
- Product
- Cisco SD-WAN vManage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Dec 19, 2022Cortex provides multi-tenant, long term storage for Prometheus.CVE-2022-23536 · Other software · cortexproject · reported by GitHubMedium 6.5
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.
- Product
- cortex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcortexmetrics.iogithub.com
May 27, 2021Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework.CVE-2021-32645 · Other software · tenancy · reported by GitHubMedium 6.1
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
- Product
- multi-tenant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2020Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter.CVE-2020-26205 · Other software · salopensource · reported by GitHubHigh 7.6
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
- Product
- Sal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster.CVE-2018-1279 · Other software · Pivotal · reported by security_alert@emc.comHigh 8.5
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.
- Product
- RabbitMq for PCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2018An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka CVE-2018-8360 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0, Microsoft .NET Framework 4.6/4.6.1/4.6.2.
- Product
- Microsoft .NET Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 5, 2016The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restriCVE-2016-6150 · Network & remote access · SAP · reported by MITRECritical 9.8
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.
- Product
- Hana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 8, 2016Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespacCVE-2016-3708 · Other software · Redhat · reported by Red HatHigh 7.1
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.