Bangladesh Vulnerability Database
An open, free reference of software vulnerabilities that affect Bangladesh.
- Sources: CVE, NVD, CISA KEV, EPSS
- Last build: 8 Nov 2026, 19:18 UTC
- Latest record change: 8 Nov 2026
- 402,058 records, 1,769 known exploited
- 402,058 CVEs in the catalog
- Updated at build time, not in real time
Latest entries
- BDVDB-2026-401819Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field DefinitionNone
- BDVDB-2026-401818Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsNone
- BDVDB-2026-401817Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORNone
- BDVDB-2026-401816Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathNone
- BDVDB-2026-401815Pie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationNone
- BDVDB-2026-401814Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data DestructionNone
- BDVDB-2026-401813FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationNone
- BDVDB-2026-401812WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerabilityMedium
- BDVDB-2026-402052BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap ParsingHigh
- BDVDB-2026-402051Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiMedium
Database statistics
- Vulnerabilities
- 402,058
- Vendors
- 28,236
- Products
- 69,456
- Contributing researchers
- 5
- Last updated
Latest vulnerabilities
View all| BDVDB ID | CVE ID | Title | Vendor | Severity | Published | Open |
|---|---|---|---|---|---|---|
| BDVDB-2026-401819 | CVE-2026-97195 | Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition | None | |||
| BDVDB-2026-401818 | CVE-2026-97194 | Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields | None | |||
| BDVDB-2026-401817 | CVE-2026-97193 | Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR | None | |||
| BDVDB-2026-401816 | CVE-2026-97192 | Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path | None | |||
| BDVDB-2026-401815 | CVE-2026-96963 | Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification | None | |||
| BDVDB-2026-401814 | CVE-2026-96961 | Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction | None | |||
| BDVDB-2026-401813 | CVE-2026-85344 | FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization | None | |||
| BDVDB-2026-401812 | CVE-2026-61987 | WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability | WC Lovers | Medium | ||
| BDVDB-2026-402052 | CVE-2026-124553 | BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing | funstory-ai | High | ||
| BDVDB-2026-402051 | CVE-2026-124552 | Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi | webmin | Medium | ||
| BDVDB-2026-402049 | CVE-2026-124494 | SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass | JiHong88 | Critical | ||
| BDVDB-2026-402048 | CVE-2026-124493 | SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent | JiHong88 | Critical | ||
| BDVDB-2026-402047 | CVE-2026-124492 | SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List | JiHong88 | High | ||
| BDVDB-2026-402045 | CVE-2026-124490 | OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument | openemr | Critical | ||
| BDVDB-2026-402044 | CVE-2026-124489 | OpenEMR before 8.3.0 Broken Access Control via portal_payment.php | openemr | High | ||
| BDVDB-2026-402043 | CVE-2026-124488 | OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters | openemr | High | ||
| BDVDB-2026-402041 | CVE-2026-124486 | OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller | openemr | High | ||
| BDVDB-2026-402039 | CVE-2026-124484 | OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs | openemr | High | ||
| BDVDB-2026-402038 | CVE-2026-124483 | OpenEMR before 8.4.0 Improper Authorization via Prescription REST API | openemr | High | ||
| BDVDB-2026-402035 | CVE-2026-124480 | OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN | openemr | High | ||
| BDVDB-2026-402032 | CVE-2026-124477 | OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php | openemr | High | ||
| BDVDB-2026-402030 | CVE-2026-124475 | OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient | openemr | High | ||
| BDVDB-2026-402024 | CVE-2026-124469 | OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter | openemr | Critical | ||
| BDVDB-2026-402006 | CVE-2026-124450 | OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument | openemr | Critical | ||
| BDVDB-2026-402001 | CVE-2026-124445 | OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force | openemr | Critical | ||
| BDVDB-2026-401996 | CVE-2026-124440 | Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass | kyverno | Critical | ||
| BDVDB-2026-401983 | CVE-2026-124427 | Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | craftcms | Critical | ||
| BDVDB-2026-401978 | CVE-2026-124331 | Jinher OA ProjectAfficheManage.aspx sql injection | Jinher | High | ||
| BDVDB-2026-401977 | CVE-2026-124330 | FlowCI flow-core-x LocalFileManager LocalFileManager.java remove path traversal | FlowCI | Medium | ||
| BDVDB-2026-401976 | CVE-2026-124329 | FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal | FlowCI | Medium | ||
| BDVDB-2026-401971 | CVE-2026-123614 | imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow | imgproxy | Critical | ||
| BDVDB-2026-401908 | CVE-2026-123551 | OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket | OpenIdentityPlatform | Critical | ||
| BDVDB-2026-400900 | CVE-2026-19868 | SonicWall SonicOS vulnerability | SonicWall | High | ||
| BDVDB-2026-399600 | CVE-2026-118527 | Ivanti Connect Secure vulnerability | Ivanti | Medium | ||
| BDVDB-2026-398702 | CVE-2026-119977 | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | WordPress | High | ||
| BDVDB-2026-396846 | CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Cisco | High | ||
| BDVDB-2026-394542 | CVE-2026-114625 | Security Advisory 0199 | Arista Networks | Critical | ||
| BDVDB-2026-394463 | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | Critical | |||
| BDVDB-2026-393939 | CVE-2026-109619 | RCE via stale global state | PHP Group | Critical | ||
| BDVDB-2026-393938 | CVE-2026-109618 | RCE via OOM corruption | PHP Group | Critical | ||
| BDVDB-2026-390189 | CVE-2026-111357 | Ivanti Connect Secure vulnerability | Ivanti | High | ||
| BDVDB-2026-390069 | CVE-2026-110936 | Siemens Software Center vulnerability | Siemens | Medium |
How it works
- 01
Collect
Reports arrive encrypted from researchers, and public records come from the CVE Program, the NVD, CISA and FIRST.
- 02
Verify
Maintainers confirm each report, work with the vendor, and record the affected and fixed versions.
- 03
Publish
The entry goes live with its scores, references and full change history, in a format anyone can reuse.
Data sources and supporters
- CVE Program (MITRE)
- National Vulnerability Database (NVD)
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- Example Sponsor (fictional)Sample
Mission
To provide a free, open, and trustworthy reference of software vulnerabilities that affect Bangladesh, in Bangla and English, so organizations can find and fix problems faster.
Vision
A safer Bangladeshi digital ecosystem where vulnerability information is open, coordinated, and locally owned.
Our values
Open data
Every record is published as plain JSON that anyone can read, reuse and check.
Coordinated disclosure
Vendors get time to fix a problem before its details become public.
Local relevance
We focus on the software that people and organizations in Bangladesh rely on.
Transparency
Sources, scores and every change to a record are visible on the record itself.
Found a vulnerability?
Report it privately. Your report is encrypted in your browser, and you can choose to be credited under a public handle.