Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Oct 27, 2026Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC.CVE-2026-116679 · Other software · m1k1o · reported by GitHubMedium 5.4
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.
- Product
- neko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML.CVE-2026-104828 · Other software · HtmlUnit · reported by GitHubHigh 7.2
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
- Product
- htmlunit-neko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user canCVE-2026-39386 · Other software · m1k1o · reported by GitHubHigh 8.8
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. The vulnerability has been patched in v3.0.11 and v3.1.2. If upgrading is not immediately possible, the following mitigations can reduce risk: Restrict access to trusted users only (avoid granting accounts to untrusted parties); ensure all user passwords are strong and only shared with trusted individuals; run the instance only when needed; avoid leaving it continuously exposed; place the instance behind authentication layers such as a reverse proxy with additional access controls; disable or restrict access to the /api/profile endpoint if feasible; and/or monitor for suspicious privilege changes or unexpected administrative actions. Note that these are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.
- Product
- neko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2022HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability.CVE-2022-29546 · Other software · Htmlunit · reported by MITREHigh 7.5
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.
- Product
- Htmlunit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption.CVE-2022-28366 · Other software · Cyberneko Html Project · reported by MITREHigh 7.5
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
- Product
- Cyberneko Html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsearch.maven.org
Apr 11, 2022org.cyberneko.html is an html parser written in Java.CVE-2022-24839 · Other software · sparklemotion · reported by GitHubHigh 7.5
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
- Product
- nekohtml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2017Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file.CVE-2017-11456 · Other software · Geneko · reported by MITREHigh 7.5
Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file.
- Product
- Gwr352 3g Router Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.securiteam.comblogs.securiteam.com
Oct 2, 2014The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackerCVE-2014-6897 · Other software · Tamrielma · reported by cret@cert.orgMedium 5.4
The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Skyrim MAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Aug 25, 2010Multiple buffer overflows in Winny 2.0b7.1 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerabilityCVE-2010-2360 · Other software · Isamu Kaneko · reported by MITREHigh 7.5
Multiple buffer overflows in Winny 2.0b7.1 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2006-2007.
- Product
- Winny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.