Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Sep 4, 2026PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport poCVE-2026-75430 · Other software · reported by MITRECritical 9.8
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 4, 2026PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.CVE-2026-75431 · Other software · reported by MITRECritical 9.1
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 4, 2026PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transporCVE-2026-75429 · Other software · reported by MITRECritical 9.8
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 31, 2026A vulnerability was identified in PowerJob up to 5.1.2.CVE-2026-82630 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2.CVE-2026-5739 · Other software · reported by VulDBMedium 6.9
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2.CVE-2026-5736 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025A vulnerability was identified in PowerJob up to 5.1.2.CVE-2025-14518 · Other software · Powerjob · reported by VulDBLow 2.1
A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025A security vulnerability has been detected in PowerJob up to 5.1.2.CVE-2025-11581 · Other software · Powerjob · reported by VulDBMedium 5.5
A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025A weakness has been identified in PowerJob up to 5.1.2.CVE-2025-11580 · Other software · Powerjob · reported by VulDBMedium 5.5
A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter.CVE-2024-44546 · Other software · powerjob · reported by MITRECritical 9.8
Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter.
- Product
- powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 17, 2023An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying vCVE-2023-36106 · Other software · Powerjob · reported by MITREHigh 7.5
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
Jul 28, 2023PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.CVE-2023-37754 · Other software · Powerjob · reported by MITRECritical 9.8
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2023PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.CVE-2023-29924 · Other software · Powerjob · reported by MITRECritical 9.8
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2023PowerJob V4.3.2 has unauthorized interface that causes remote code execution.CVE-2023-29926 · Other software · Powerjob · reported by MITRECritical 9.8
PowerJob V4.3.2 has unauthorized interface that causes remote code execution.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.CVE-2023-29922 · Other software · Powerjob · reported by MITREMedium 5.3
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023PowerJob V4.3.1 is vulnerable to Insecure Permissions.CVE-2023-29923 · Other software · Powerjob · reported by MITREMedium 5.3
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.CVE-2023-29921 · Other software · Powerjob · reported by MITREMedium 5.3
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.CVE-2020-28865 · Other software · Powerjob · reported by MITREHigh 7.5
An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.
- Product
- Powerjob
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.