Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Apr 30, 2026In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records.CVE-2026-40684 · Other software · Exim · reported by MITREMedium 5.9
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
- Product
- Exim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026An issue was discovered in musl libc 0.7.10 through 1.2.6.CVE-2026-40200 · Other software · musl-libc · reported by MITREHigh 8.1
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).
- Product
- musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmusl.libc.orgopenwall.com
Apr 10, 2026A security flaw has been discovered in musl libc up to 1.2.6.CVE-2026-6042 · Other software · musl · reported by VulDBMedium 4.8
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.
- Product
- libc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UCVE-2025-26519 · Other software · musl-libc · reported by MITREHigh 8.1
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
- Product
- musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.musl-libc.orggit.musl-libc.org
Jan 9, 2025Muslim Prayer Time-Salah/Iqamah: Stored Cross-Site ScriptingCVE-2024-12515 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Muslim Prayer Time-Salah/Iqamah plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Masjid ID parameter in all versions up to, and including, 1.8.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Muslim Prayer Time-Salah/Iqamah
- Affected
- up to 1.8.11
- What to do
- Affects up to 1.8.11. Update Muslim Prayer Time-Salah/Iqamah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 26, 2024Muslim Prayer Time BD: Does not have CSRF check in placeCVE-2024-4758 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Muslim Prayer Time BD
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Muslim Prayer Time BD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2020In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid wCVE-2020-28928 · Other software · Musl-libc · reported by MITREMedium 5.5
In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow).
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Feb 19, 2020Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote atCVE-2014-3484 · Other software · Musl-libc · reported by Red HatCritical 9.8
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.musl-libc.orgseclists.org
Aug 6, 2019musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory.CVE-2019-14697 · Other software · Musl-libc · reported by MITRECritical 9.8
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity.gentoo.org
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.CVE-2017-17988 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.CVE-2017-17987 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 7.2
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.CVE-2017-17986 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.CVE-2017-17985 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.CVE-2017-17984 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 4.8
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.CVE-2017-17983 · Other software · Muslim Matrimonial Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.CVE-2017-17982 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 6.8
PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.CVE-2017-17981 · Other software · Muslim Matrimonial Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.CVE-2017-17639 · Other software · Muslim Matrimonial Script Project · reported by MITRECritical 9.8
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
- Product
- Muslim Matrimonial Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 19, 2017musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresCVE-2017-15650 · Other software · Musl-libc · reported by MITREHigh 7.5
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.musl-libc.orggit.musl-libc.org
Aug 18, 2017Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to haveCVE-2015-1817 · Other software · Musl-libc · reported by Red HatCritical 9.8
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Feb 13, 2017Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggCVE-2016-8859 · Other software · Etalabs · reported by MITRECritical 9.8
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Oct 21, 2014The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2014-7789 · Other software · Zillionmuslims · reported by cret@cert.orgMedium 5.4
The Zillion Muslims (aka com.zillionmuslims.src) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Zillion Muslims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Aug 31, 2012Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execCVE-2012-2114 · Other software · Etalabs · reported by Red HatHigh 7.5
Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string to an unbuffered stream such as stderr.
- Product
- Musl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordetalabs.netopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.