Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Oct 13, 2026A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8.CVE-2026-109526 · Other software · HBAI-Ltd · reported by VulDBLow 1.9
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
- Product
- Toonflow-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Oct 13, 2026A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8.CVE-2026-109409 · Other software · HBAI-Ltd · reported by VulDBLow 1.9
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
- Product
- Toonflow-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 2, 2026TOON is a compact, human-readable serialization of JSON data for LLM prompts.CVE-2026-82404 · Other software · toon-format · reported by GitHubHigh 8.3
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.__proto__.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own __proto__ properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.
- Product
- toon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1.CVE-2026-7086 · Other software · HBAI-Ltd · reported by VulDBLow 2.1
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that "[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations."
- Product
- Toonflow-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1.CVE-2026-7085 · Other software · HBAI-Ltd · reported by VulDBLow 1.3
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1. This vulnerability affects the function z.url of the file src/routes/setting/about/downloadApp.ts of the component downloadApp Endpoint. This manipulation of the argument url causes path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The real existence of this vulnerability is still doubted at the moment. The vendor explains in a reply to the issue report, that "[t]his interface is used for online updates, and the update URL has been statically compiled in the official code repository. Unless users modify the code, the requested address will be the official source address."
- Product
- Toonflow-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1.CVE-2026-7084 · Other software · HBAI-Ltd · reported by VulDBLow 2.1
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that "[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it."
- Product
- Toonflow-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022In sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message without permissions due to a missing permission check.CVE-2021-39734 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In sendMessage of OneToOneChatImpl.java (? TBD), there is a possible way to send an RCS message without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-208650395References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 17, 2018An issue was discovered in DESTOON B2B 7.0.CVE-2018-18433 · Other software · Destoon · reported by MITREMedium 4.8
An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI.
- Product
- Destoon B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018An issue was discovered in DESTOON B2B 7.0.CVE-2018-18432 · Other software · Destoon · reported by MITREHigh 8.8
An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request.
- Product
- Destoon B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018An issue was discovered in DESTOON B2B 7.0.CVE-2018-18431 · Other software · Destoon · reported by MITREMedium 4.8
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.
- Product
- Destoon B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2018An issue was discovered in DESTOON B2B 7.0.CVE-2018-18430 · Other software · Destoon · reported by MITREMedium 4.8
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.
- Product
- Destoon B2b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for Carrot, an Ethereum token, has an integer overflow that allows the owner of the contract to set thCVE-2018-13491 · Other software · Carrot Cartoon Book Coin Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for Carrot, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Carrot Cartoon Book Coin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2014The Cartoon Camera (aka com.fingersoft.cartooncamera) application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-theCVE-2014-5618 · Other software · Fingersoft · reported by cret@cert.orgMedium 5.4
The Cartoon Camera (aka com.fingersoft.cartooncamera) application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cartoon Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.