Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
604 results · page 1 of 13
Oct 30, 2026Zuke is a code-first, strongly typed build automation system for Deno.CVE-2026-119291 · Other software · zuke-build · reported by GitHubMedium 5.5
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.
- Product
- zuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Zuke is a code-first, strongly typed build automation system for Deno.CVE-2026-119290 · Other software · zuke-build · reported by GitHubHigh 7.5
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
- Product
- zuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Zuke is a code-first, strongly typed build automation system for Deno.CVE-2026-119289 · Other software · zuke-build · reported by GitHubHigh 7.1
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.
- Product
- zuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Zuke is a code-first, strongly typed build automation system for Deno.CVE-2026-119288 · Other software · zuke-build · reported by GitHubHigh 7
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
- Product
- zuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Zuke is a code-first, strongly typed build automation system for Deno.CVE-2026-119287 · Other software · zuke-build · reported by GitHubHigh 8
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.
- Product
- zuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), externalCVE-2026-98510 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref. Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race. (cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 13, 2026Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition CVE-2026-110240 · Other software · duke-git · reported by VulnCheckMedium 6.3
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
- Product
- lancet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encodedCVE-2021-48011 · Other software · lukejacksonn · reported by VulnCheckHigh 8.7
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.
- Product
- servor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounCVE-2026-84854 · Other software · wibu-systems-ag · reported by 2fc02b1f-71e7-4514-a878-169626f68903High 7
In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.
- Product
- wibukey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.wibu.comcert-portal.siemens.com
Sep 16, 2026Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addreCVE-2026-92565 · Other software · lukevella · reported by VulnCheckMedium 6.9
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the CVE-2026-81581 · Other software · wibu-systems-ag · reported by 2fc02b1f-71e7-4514-a878-169626f68903High 8.8
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
- Product
- wibukey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploCVE-2026-81579 · Other software · wibu-systems-ag · reported by 2fc02b1f-71e7-4514-a878-169626f68903High 8.8
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
- Product
- wibukey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026NukeViet CMS is a multi Content Management System.CVE-2026-41147 · Other software · nukeviet · reported by GitHubHigh 8.7
NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content, which can be bypassed by intercepting and modifying HTTP requests directly (e.g., using Burp Suite). An attacker can inject malicious payloads which are stored server-side and executed in the browser of any user who views the content. Anyone viewing user-submitted content (such as administrators and moderators reviewing contact messages or comments) is impacted, and the vulnerability can be exploited by any anonymous visitor without authentication, with the Contact module used only as a proof of concept. Potential consequences include session hijacking through cookie theft, unauthorized actions performed under the victim's identity, defacement or redirection to phishing pages, and phishing attacks via manipulated email notifications. This issue has been fixed in version 4.5.08. If developers are unable to upgrade immediately, they should work around this
- Product
- nukeviet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encouCVE-2026-43250 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 17, 2026Movary is a self hosted web app to track and rate a user's watched movies.CVE-2026-40350 · Other software · leepeuker · reported by GitHubHigh 8.8
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a broken boolean condition. As a result, any user with a valid web session cookie can reach functionality that should be restricted to administrators. Version 0.71.1 patches the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Movary is a self hosted web app to track and rate a user's watched movies.CVE-2026-40349 · Other software · leepeuker · reported by GitHubHigh 8.8
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for their own user ID. The endpoint is intended to let a user edit their own profile, but it updates the sensitive `isAdmin` field without any admin-only authorization check. Version 0.71.1 patches the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Movary is a self hosted web app to track and rate a user's watched movies.CVE-2026-40348 · Other software · leepeuker · reported by GitHubHigh 7.7
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40321 · Other software · dnnsoftware · reported by GitHubHigh 8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40306 · Other software · dnnsoftware · reported by GitHubMedium 6.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-40305 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026A flaw has been found in lukevella rallly up to 4.7.4.CVE-2026-6493 · Other software · lukevella · reported by VulDBLow 2
A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 5, 2026Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php.CVE-2026-1953 · Other software · Nukegraphic CMS · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 8.2
Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in the database and rendering it across multiple CMS pages. An authenticated attacker with low privileges can inject malicious JavaScript payloads through the profile edit request, which are then executed site-wide whenever the affected user's name is displayed. This allows the attacker to execute arbitrary JavaScript in the context of other users' sessions, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims.
- Product
- Nukegraphic CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through jCVE-2020-37103 · Other software · Dnnsoftware · reported by VulnCheckMedium 5.1
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks.
- Product
- DotNetNuke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddnnsoftware.commedium.com
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24838 · Other software · dnnsoftware · reported by GitHubCritical 9.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24837 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24836 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24833 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24784 · Other software · dnnsoftware · reported by GitHubMedium 6.8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23841 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryCreated=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23840 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryDeleted=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Movary is a web application to track, rate and explore your movie watch history.CVE-2026-23839 · Other software · leepeuker · reported by GitHubCritical 9.3
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary codCVE-2021-47810 · Other software · Wibu · reported by VulnCheckHigh 8.5
WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe' to inject malicious executables and escalate privileges.
- Product
- WibuKey Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Dec 18, 2025An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48CVE-2025-63951 · Other software · Sourcefabric · reported by MITREHigh 7.5
An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service.
- Product
- Phoniebox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-66027 · Other software · lukevella · reported by GitHubHigh 7.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65034 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65033 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not verify whether the user performing the action is the poll owner. As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65032 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the participantId parameter in a rename request, an attacker can modify another user’s name, violating data integrity and potentially causing confusion or impersonation attacks. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65031 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments under arbitrary usernames, including privileged ones such as administrators, potentially misleading other users and enabling phishing or social engineering attacks. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65030 · Other software · lukevella · reported by GitHubHigh 7.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpoint relies solely on the comment ID for deletion and does not validate whether the requesting user owns the comment or has permission to remove it. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65029 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint relies solely on a participant ID to authorize deletions, enabling attackers to remove other users (including poll owners) from polls. This impacts the integrity and availability of poll participation data. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65028 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to identify which votes to update, without verifying ownership or poll permissions. This allows an attacker to alter poll results in their favor, directly compromising data integrity. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65021 · Other software · lukevella · reported by GitHubCritical 9.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other users’ polls and convert them into events without proper authorization checks, potentially disrupting user workflows and causing data integrity and availability issues. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65020 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Movary is a web application to track, rate and explore your movie watch history.CVE-2025-64116 · Other software · leepeuker · reported by GitHubMedium 5.1
Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validation, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Movary is a web application to track, rate and explore your movie watch history.CVE-2025-64115 · Other software · leepeuker · reported by GitHubMedium 5.1
Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.
- Product
- movary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64095 · Other software · dnnsoftware · reported by GitHubCritical 10
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64094 · Other software · dnnsoftware · reported by GitHubMedium 6.4
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-62802 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2025-59951 · Other software · LukeGus · reported by GitHubCritical 9.2
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the backend to retrieve the proxy's IP instead of the client's IP when using the req.ip method. This results in isLocalhost always returning True. Consequently, the /ssh/db/host/internal endpoint can be accessed directly without login or authentication. This endpoint records the system's stored SSH host information, including addresses, usernames, and passwords, posing an extremely high security risk. Users who use the official Termix docker image, build their own image using the official dockerfile, or utilize reverse proxy functionality will be affected by this vulnerability. This issue is fixed in version 1.6.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59821 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.