Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
46 results
Oct 16, 2026Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privilegCVE-2026-109119 · Other software · ikus-soft · reported by cve@gitlab.comHigh 8.8
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
- Product
- rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve toCVE-2026-109118 · Other software · ikus-soft · reported by cve@gitlab.comMedium 4.6
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
- Product
- rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users.CVE-2025-67796 · Other software · reported by MITREHigh 8.1
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.CVE-2023-5289 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.CVE-2023-4138 · Other software · ikus060 · reported by security@huntr.devMedium 6.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4724 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4723 · Other software · ikus060 · reported by security@huntr.devMedium 6.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4722 · Other software · ikus060 · reported by security@huntr.devHigh 7.2
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4721 · Other software · ikus060 · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4720 · Other software · ikus060 · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4719 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.CVE-2022-4646 · Other software · ikus060 · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.CVE-2022-4644 · Other software · ikus060 · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.CVE-2022-4314 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-4018 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3362 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.CVE-2022-3363 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.CVE-2022-3327 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3439 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.CVE-2022-3457 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.CVE-2022-3456 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3438 · Other software · ikus060 · reported by security@huntr.devMedium 6.1
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.CVE-2022-3389 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3376 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.CVE-2022-3273 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.CVE-2022-3371 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.CVE-2022-3364 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.CVE-2022-3326 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3292 · Other software · ikus060 · reported by security@huntr.devMedium 4.6
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3298 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3290 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3272 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3295 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.CVE-2022-3301 · Other software · ikus060 · reported by security@huntr.devLow 2.4
Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.CVE-2022-3269 · Other software · ikus060 · reported by security@huntr.devCritical 9.8
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.CVE-2022-3274 · Other software · ikus060 · reported by security@huntr.devLow 3.5
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3267 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3233 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.CVE-2022-3250 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.CVE-2022-3232 · Other software · ikus060 · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.CVE-2022-3221 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3179 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3175 · Other software · ikus060 · reported by security@huntr.devMedium 5.3
Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-3174 · Other software · ikus060 · reported by security@huntr.devHigh 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.CVE-2022-3167 · Other software · ikus060 · reported by security@huntr.devHigh 8.8
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2007Directory traversal vulnerability in rdw_helpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a ..CVE-2007-2747 · Other software · Rdiffweb · reported by MITREMedium 5
Directory traversal vulnerability in rdw_helpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to the /browse URI.
- Product
- Rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.