Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Aug 19, 2026A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4.CVE-2026-76572 · Other software · pkp · reported by VulDBMedium 5.1
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.
- Product
- pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0.CVE-2026-19906 · Other software · pkp · reported by VulDBMedium 6.3
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.
- Product
- pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function.CVE-2024-46326 · Other software · pkp · reported by MITREMedium 6.1
Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function.
- Product
- pkb-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Nov 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5904 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5903 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5902 · Other software · pkp · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5901 · Other software · pkp · reported by security@huntr.devLow 3.5
Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5900 · Other software · pkp · reported by security@huntr.devLow 3.5
Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2023PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file naCVE-2023-47271 · Other software · SFU · reported by MITREMedium 5.3
PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
- Product
- PKP Web Application Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 31, 2023Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5899 · Other software · pkp · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5898 · Other software · pkp · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.CVE-2023-5896 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5895 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5893 · Other software · pkp · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5892 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5891 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5890 · Other software · pkp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-5889 · Other software · pkp · reported by security@huntr.devHigh 8.2
Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.CVE-2023-4695 · Other software · pkp · reported by security@huntr.devHigh 8.1
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
- Product
- pkp/pkp-lib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2019An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2.CVE-2019-19909 · Other software · SFU · reported by MITREHigh 8.8
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
- Product
- Open Journal System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.