Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Oct 11, 2026Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-onlCVE-2026-108756 · Other software · Abilityai · reported by VulnCheckMedium 5.3
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.
- Product
- trinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.CVE-2026-54839 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
- What to do
- Update the plugin to the newest version.
Dec 9, 2025Trinity Audio: Missing AuthorizationCVE-2025-67466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.
- Product
- Trinity Audio
- Affected
- up to 5.23.3
- What to do
- Affects up to 5.23.3. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Sensitive Information ExposureCVE-2025-9196 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.
- Product
- Trinity Audio – Text to Speech AI audio player to convert content into audio
- Affected
- up to 5.21.0
- What to do
- Affects up to 5.21.0. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Reflected Cross-Site ScriptingCVE-2025-9952 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Trinity Audio – Text to Speech AI audio player to convert content into audio
- Affected
- up to 5.20.2
- What to do
- Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Cross-Site Request ForgeryCVE-2025-9886 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Trinity Audio – Text to Speech AI audio player to convert content into audio
- Affected
- up to 5.20.2
- What to do
- Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Trinity Audio: Missing AuthorizationCVE-2025-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
- Product
- Trinity Audio
- Affected
- up to 5.20.0
- What to do
- Affects up to 5.20.0. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2023 StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352) CVE-2023-39372 · Other software · StarTrinity · reported by cna@cyber.gov.ilHigh 8.1
StarTrinity Softswitch version 2023-02-16 - Multiple CSRF (CWE-352)
- Product
- Softswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023 StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601) CVE-2023-39371 · Other software · StarTrinity · reported by cna@cyber.gov.ilHigh 8.8
StarTrinity Softswitch version 2023-02-16 - Open Redirect (CWE-601)
- Product
- Softswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023 StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) CVE-2023-39370 · Other software · StarTrinity · reported by cna@cyber.gov.ilHigh 8.8
StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)
- Product
- Softswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023 StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79) CVE-2023-39369 · Other software · StarTrinity · reported by cna@cyber.gov.ilHigh 8.8
StarTrinity Softswitch version 2023-02-16 - Multiple Reflected XSS (CWE-79)
- Product
- Softswitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2015Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remCVE-2015-7748 · Network & remote access · Juniper · reported by MITREMedium 5
Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.
- Product
- Junos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netsecurityfocus.com
May 31, 2007Centrinity FirstClass 8.3 and earlier, and Server and Internet Services 8.0 and earlier, do not properly handle a URL with a null ("%00") character, which allowCVE-2007-2976 · Other software · Opentext · reported by MITREMedium 4.3
Centrinity FirstClass 8.3 and earlier, and Server and Internet Services 8.0 and earlier, do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS) attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Firstclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute CVE-2005-1045 · Other software · Centrinity · reported by MITREHigh 7.5
OpenText FirstClass 8.0 client does not properly sanitize strings before passing them to the Windows ShellExecute API, which allows remote attackers to execute arbitrary commands via a UNC path in a bookmark.
- Product
- Centrinity Firstclass Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2003Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search optioCVE-2003-1173 · Other software · reported by MITREMedium 5
Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search option checkboxes and leaving the text field blank, which will return all files in the searched directory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2001Centrinity First Class Internet Services 5.50 allows for the circumventing of the default 'spam' filters via the presence of '<@>' in the 'From:' field, which aCVE-2001-0631 · Other software · Opentext · reported by MITREMedium 5
Centrinity First Class Internet Services 5.50 allows for the circumventing of the default 'spam' filters via the presence of '<@>' in the 'From:' field, which allows remote attackers to send spoofed email with the identity of local users.
- Product
- Firstclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Jun 27, 2000FirstClass Internet Services server 5.770, and other versions before 6.1, allows remote attackers to cause a denial of service by sending an email with a long TCVE-2000-0570 · Other software · Centrinity · reported by MITREMedium 5
FirstClass Internet Services server 5.770, and other versions before 6.1, allows remote attackers to cause a denial of service by sending an email with a long To: mail header.
- Product
- Firstclass Intranet Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.