Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Dec 11, 2025OSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityCVE-2025-58360 · Other software · OSGeo · reported by GitHubExploitedHigh 8.2
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
- Product
- GeoServer
- On CISA’s list since
- Dec 11, 2025 (federal fix deadline Jan 1, 2026)
- What to do
- Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comosgeo-org.atlassian.net
Jul 1, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
- Product
- TM SGNL
- On CISA’s list since
- Jul 1, 2025 (federal fix deadline Jul 22, 2025)
- What to do
- Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogwired.comcisa.gov
Jul 1, 2025TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityCVE-2025-48927 · Other software · TeleMessage · reported by MITREExploitedMedium 5.3
TeleMessage TM SGNL contains an initialization of a resource with an insecure default vulnerability. This vulnerability relies on how the Spring Boot Actuator is configured with an exposed heap dump endpoint at a /heapdump URI.
- Product
- TM SGNL
- On CISA’s list since
- Jul 1, 2025 (federal fix deadline Jul 22, 2025)
- What to do
- Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogwired.comcisa.gov
May 12, 2025TeleMessage TM SGNL Hidden Functionality VulnerabilityCVE-2025-47729 · Other software · TeleMessage · reported by MITREExploitedLow 1.9
TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM SGNL application users.
- Product
- TM SGNL
- On CISA’s list since
- May 12, 2025 (federal fix deadline Jun 2, 2025)
- What to do
- Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogarstechnica.comnews.ycombinator.com
Jul 15, 2024OSGeo GeoServer GeoTools Eval Injection VulnerabilityCVE-2024-36401 · Other software · OSGeo · reported by GitHubExploitedCritical 9.8
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
- Product
- GeoServer
- On CISA’s list since
- Jul 15, 2024 (federal fix deadline Aug 5, 2024)
- What to do
- Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Jun 26, 2024OSGeo GeoServer JAI-EXT Code Injection VulnerabilityCVE-2022-24816 · Other software · OSGeo · reported by GitHubExploitedCritical 10
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
- Product
- JAI-EXT
- On CISA’s list since
- Jun 26, 2024 (federal fix deadline Jul 17, 2024)
- What to do
- Attackers are using this now. Install OSGeo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
May 26, 2023Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityCVE-2023-2868 · Network & remote access · Barracuda Networks · reported by cve-coordination@google.comExploitedCritical 9.4
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.
- Product
- Email Security Gateway (ESG) Appliance
- On CISA’s list since
- May 26, 2023 (federal fix deadline Jun 16, 2023)
- What to do
- Attackers are using this now. Install Barracuda Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogstatus.barracuda.combarracuda.com
Mar 25, 2022Sophos SG UTM Remote Code Execution VulnerabilityCVE-2020-25223 · Network & remote access · Sophos · reported by MITREExploitedCritical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
- Product
- SG UTM
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comcommunity.sophos.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.