Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Aug 18, 2026Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-70792 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Yard Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-62496 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Yard Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026YARD is a documentation generation tool for the Ruby programming language.CVE-2026-49342 · Other software · lsegal · reported by GitHubMedium 5.3
YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as `/../yard-cache-secret.html` is joined against that root and can return a readable sibling `.html` file outside the intended static tree. Version 0.9.44 patches the issue.
- Product
- yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026YARD is a Ruby Documentation tool.CVE-2026-41493 · Other software · lsegal · reported by GitHubMedium 6.9
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
- Product
- yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Dockyard is a Docker container management app.CVE-2026-39848 · Other software · 10ij · reported by GitHubMedium 6.5
Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name=<container> or /apps/action.php?action=start&name=<container>, which starts or stops the target container. This vulnerability is fixed in 1.1.0.
- Product
- dockyard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources.CVE-2026-31151 · Other software · Kaleris · reported by MITRECritical 9.8
An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources.
- Product
- Yard Management Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources.CVE-2026-31150 · Other software · Kaleris · reported by MITREMedium 4.3
Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources.
- Product
- Yard Management Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Community Yard Sale: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51846 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Community Yard Sale community-yard-sale allows Stored XSS.This issue affects Community Yard Sale: from n/a through <= 1.1.11.
- Product
- Community Yard Sale
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update Community Yard Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2024SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter.CVE-2024-30974 · Other software · tramyardg · reported by MITREHigh 7.3
SQL Injection vulnerability in autoexpress v.1.3.0 allows attackers to run arbitrary SQL commands via the carId parameter.
- Product
- autoexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML wCVE-2023-48903 · Other software · tramyardg · reported by MITREMedium 6.1
Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php.
- Product
- autoexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 21, 2024An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehiclesCVE-2023-48902 · Other software · tramyardg · reported by MITRECritical 9.8
An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php.
- Product
- autoexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 21, 2024A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameteCVE-2023-48901 · Other software · tramyardg · reported by MITRECritical 9.8
A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php.
- Product
- autoexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 28, 2024YARD is a Ruby Documentation tool.CVE-2024-27285 · Other software · lsegal · reported by GitHubMedium 5.4
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in 0.9.36.
- Product
- yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023Yellow Yard Searchbar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1110 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.12
- What to do
- Update Yellow Yard Searchbar to 2.8.12 or newer.
Feb 8, 2023Yellow Yard Searchbar: Does not escape some URL parameters before outputting them back to the userCVE-2022-2094 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.2
- What to do
- Update Yellow Yard Searchbar to 2.8.2 or newer.
Feb 1, 2023Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).CVE-2022-47717 · Other software · Lastyard · reported by MITREHigh 7.5
Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
- Product
- Last Yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.CVE-2022-47715 · Other software · Lastyard · reported by MITREMedium 5.3
In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
- Product
- Last Yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Last Yard 22.09.8-1 does not enforce HSTS headersCVE-2022-47714 · Other software · Lastyard · reported by MITRECritical 9.8
Last Yard 22.09.8-1 does not enforce HSTS headers
- Product
- Last Yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.CVE-2022-48091 · Other software · Hotel Management System Project · reported by MITREMedium 5.4
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.CVE-2022-48090 · Other software · Hotel Management System Project · reported by MITREMedium 6.5
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary CVE-2022-36254 · Other software · Hotel Management System Project · reported by MITREMedium 5.4
Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 13, 2022Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.CVE-2022-27475 · Other software · Hotel Management System Project · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration.CVE-2021-25981 · Other software · debiki · reported by vulnerabilitylab@mend.ioCritical 9.8
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
- Product
- talkyard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular throCVE-2021-25980 · Other software · debiki · reported by vulnerabilitylab@mend.ioHigh 8.8
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
- Product
- talkyard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Jul 29, 2019yard before 0.9.20 allows path traversal.CVE-2019-1020001 · Other software · yard · reported by josh@bress.netHigh 7.5
yard before 0.9.20 allows path traversal.
- Product
- yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 28, 2017lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct direCVE-2017-17042 · Other software · Yardoc · reported by MITREHigh 7.5
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
- Product
- Yard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2014The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midCVE-2014-7791 · Other software · Appsgeyser · reported by cret@cert.orgMedium 5.4
The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Backyard Wrestling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 20, 2014The Vineyard All In (aka com.wVineyardAllIn) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attCVE-2014-7488 · Other software · Highlighterstudio · reported by cret@cert.orgMedium 5.4
The Vineyard All In (aka com.wVineyardAllIn) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Vineyard ALL IN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Aug 9, 2013Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) oCVE-2013-4147 · Other software · Yard Radius Project · reported by Red HatHigh 7.5
Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in a request in the (1) log_msg function in log.c or (2) version or (3) build_version function in version.c.
- Product
- Yard Radius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgcxsecurity.com
Jul 24, 2009SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.CVE-2009-2592 · Websites & servers · Phpjunkyard · reported by MITREHigh 7.5
SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.
- Product
- Gbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexchange.xforce.ibmcloud.com
Dec 4, 2006Directory traversal vulnerability in mboard.php in PHPJunkYard (aka Klemen Stirn) MBoard 1.22 and earlier allows remote attackers to create arbitrary empty fileCVE-2006-6262 · Websites & servers · Phpjunkyard · reported by MITREMedium 6.4
Directory traversal vulnerability in mboard.php in PHPJunkYard (aka Klemen Stirn) MBoard 1.22 and earlier allows remote attackers to create arbitrary empty files via a .. (dot dot) in the orig_id parameter.
- Product
- Phpjunkyard Mboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Jan 10, 2005Buffer overflow in the process_menu function in yardradius 1.0.20 allows remote attackers to execute arbitrary code.CVE-2004-0987 · Other software · Yard Radius · reported by MITREHigh 10
Buffer overflow in the process_menu function in yardradius 1.0.20 allows remote attackers to execute arbitrary code.
- Product
- Yard Radius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgdebian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.