Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Sep 16, 2026A flaw was found in sequoia-openpgp.CVE-2026-42784 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
- Product
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 12, 2026An access issue was addressed with additional sandbox restrictions.CVE-2025-43524 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox.
- Product
- macOS Sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A flaw was found in rust-rpm-sequoia.CVE-2026-2625 · Other software · Red Hat · reported by Red HatMedium 4
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 14, 2025In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short.CVE-2025-67897 · Other software · sequoia-pgp · reported by MITREMedium 5.3
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
- Product
- sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggitlab.com
Jul 27, 2025The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.CVE-2023-53161 · Other software · sequoia-pgp · reported by MITRELow 2.9
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
- Product
- buffered-reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.CVE-2023-53160 · Other software · sequoia-pgp · reported by MITRELow 2.9
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
- Product
- sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2025The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParCVE-2024-58261 · Other software · sequoia-pgp · reported by MITRELow 2.9
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
- Product
- sequoia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.