Latest high and critical flaws
- CVE-2026-63174 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside theiHigh 8.6 · Oct 13, 2026
- CVE-2026-63172 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts bHigh 7.1 · Oct 13, 2026
- CVE-2026-63165 Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manHigh 8.6 · Oct 13, 2026
- CVE-2026-63163 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to dHigh 8.7 · Oct 13, 2026
- CVE-2026-63162 Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary dirHigh 8.7 · Oct 13, 2026
- CVE-2026-63161 Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a knoHigh 8.6 · Oct 13, 2026
- CVE-2026-63160 Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value iCritical 9.1 · Oct 13, 2026
- CVE-2026-63159 Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accountCritical 9.1 · Oct 13, 2026
- CVE-2026-63158 Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to Critical 9.1 · Oct 13, 2026
- CVE-2026-63154 Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying cHigh 8.7 · Oct 13, 2026
- CVE-2026-63153 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-High 8.6 · Oct 13, 2026
- CVE-2026-63152 Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _High 8.6 · Oct 13, 2026
- CVE-2026-63149 Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords genCritical 9.1 · Oct 13, 2026
- CVE-2026-63146 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php cCritical 9.3 · Oct 13, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.