Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Apr 21, 2026Oxia is a metadata store and coordination system.CVE-2026-40946 · Other software · oxia-db · reported by GitHubCritical 9.2
Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia. This vulnerability is fixed in 0.16.2.
- Product
- oxia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Oxia is a metadata store and coordination system.CVE-2026-40945 · Other software · oxia-db · reported by GitHubHigh 8.7
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.
- Product
- oxia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Oxia is a metadata store and coordination system.CVE-2026-40944 · Other software · oxia-db · reported by GitHubMedium 6.9
Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS. This vulnerability is fixed in 0.16.2.
- Product
- oxia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Oxia is a metadata store and coordination system.CVE-2026-40943 · Other software · oxia-db · reported by GitHubHigh 8.7
Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server to panic with send on closed channel. The heartbeat() method uses a blocking channel send while holding a mutex, and under specific timing with concurrent close() calls, this can lead to either a deadlock (channel buffer full) or a panic (send on closed channel after TOCTOU gap in KeepAlive). This vulnerability is fixed in 0.16.2.
- Product
- oxia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/cCVE-2025-44034 · Other software · Aaluoxiang · reported by MITREHigh 8
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.CVE-2025-29592 · Other software · Aaluoxiang · reported by MITREMedium 5.6
oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/javCVE-2025-44033 · Other software · Aaluoxiang · reported by MITRECritical 9.8
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical.CVE-2025-6829 · Other software · aaluoxiang · reported by VulDBMedium 5.3
A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5.CVE-2025-5545 · Other software · aaluoxiang · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. This affects the function image of the file src/main/java/cn/gson/oasys/controller/process/ProcedureController.java. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5.CVE-2025-5544 · Other software · aaluoxiang · reported by VulDBMedium 5.3
A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0.CVE-2025-1958 · Other software · aaluoxiang · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some unknown processing of the file src/main/resources/mappers/address-mapper.xml. The manipulation of the argument outtype leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that CVE-2024-7726 · Other software · Kioxia · reported by cve-coordination@google.comMedium 5.7
There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up.
- Product
- CM6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).CVE-2023-48176 · Other software · Mizhexiaoxiao · reported by MITRECritical 9.8
An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).
- Product
- Websiteguide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprairie-steed-4d7.notion.siteprairie-steed-4d7.notion.site
Dec 17, 2019Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < CVE-2019-18956 · Other software · Divisait · reported by MITRECritical 9.8
Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
- Product
- Dv2eemvc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes.CVE-2018-14529 · Other software · Invoxia · reported by MITREHigh 7.5
Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes.
- Product
- Nvx220 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019Invoxia NVX220 devices allow TELNET access as admin with a default password.CVE-2018-14528 · Other software · Invoxia · reported by MITRECritical 9.8
Invoxia NVX220 devices allow TELNET access as admin with a default password.
- Product
- Nvx220 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2018gaoxiaotingtingting is an HTTP server.CVE-2017-16108 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
- Product
- gaoxiaotingtingting node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.