Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13,061 results · page 10 of 262
Oct 14, 2026An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior tCVE-2026-85298 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.3
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.
- Product
- Application Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comdocs.cloud.google.com
Oct 14, 2026The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent iteCVE-2026-103904 · Other software · JTL-Software GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.6
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
- Product
- JTL-Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026SellKit: Does not validate a client-supplied product priceCVE-2026-94254 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.
- Product
- SellKit
- Fixed in
- 2.8.0
- What to do
- Update SellKit to 2.8.0 or newer.
Oct 14, 2026Pricing Table: Does not validate the scheme of a user-supplied link value in one of its blocks before rendering itCVE-2026-86797 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content.
- Product
- Pricing Table
- Fixed in
- 2.1.5
- What to do
- Update Pricing Table to 2.1.5 or newer.
Oct 14, 2026FV Flowplayer Video Player: Does not properly validate a user-supplied URL before performing a server-side fetchCVE-2026-85345 · WordPress plugins & themes · reported by WPScanMedium 4.1
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.55.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.55.7212 or newer.
Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
- Product
- File Upload to Order
- Fixed in
- 1.1.4
- What to do
- Update File Upload to Order to 1.1.4 or newer.
Oct 14, 2026Ultimate Multisite: Does not validate a user-supplied value used to select a file to includeCVE-2026-107508 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
- Product
- Ultimate Multisite
- Fixed in
- 2.17.2
- What to do
- Update Ultimate Multisite to 2.17.2 or newer.
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or validation on one of its REST routes that writes to the databaseCVE-2026-107158 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
- Product
- LTL Freight Quotes
- Fixed in
- 4.2.19
- What to do
- Update LTL Freight Quotes to 4.2.19 or newer.
Oct 14, 2026Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.CVE-2026-50218 · Other software · Akamai · reported by MITREHigh 8.5
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
- Product
- Guardicore Platform Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtechdocs.akamai.comakamai.com
Oct 14, 2026A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI KeyCVE-2026-110455 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 8.1
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
- Product
- UniFi Protect AI Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.CVE-2026-92817 · Other software · Inductive Automation · reported by ics-cert@hq.dhs.govHigh 8.7
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
- Product
- Ignition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.inductiveautomation.com
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-48378 · Other software · Adobe · reported by AdobeMedium 5.3
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-48377 · Other software · Adobe · reported by AdobeMedium 5.3
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-104345 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-103294 · Other software · Adobe · reported by AdobeMedium 5.9
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-102501 · Other software · Adobe · reported by AdobeMedium 5.3
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100135 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100125 · Other software · Adobe · reported by AdobeMedium 5.9
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100124 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-100123 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-100122 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-100121 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100120 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100119 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-100118 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100117 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass.CVE-2026-100116 · Other software · Adobe · reported by AdobeMedium 5.9
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-100113 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute.CVE-2026-78633 · Other software · Okta · reported by psirt@okta.comMedium 6.5
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
- Product
- Okta RADIUS Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure.CVE-2026-78628 · Other software · Okta · reported by psirt@okta.comMedium 6
The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.
- Product
- Okta Credential Provider for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-75995 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the CVE-2026-107371 · Other software · Auth0 · reported by psirt@okta.comMedium 5.4
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.
- Product
- auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrust.okta.com
Oct 13, 2026The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL.CVE-2026-107369 · Other software · Auth0 · reported by psirt@okta.comMedium 6.1
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.
- Product
- nextjs-auth0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrust.okta.com
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106619 · Websites & servers · Adobe · reported by AdobeCritical 9
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-106613 · Websites & servers · Adobe · reported by AdobeHigh 8.8
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.CVE-2026-105900 · Websites & servers · Adobe · reported by AdobeHigh 7.5
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current uCVE-2026-106626 · Other software · Adobe · reported by AdobeCritical 9.1
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current uCVE-2026-105895 · Other software · Adobe · reported by AdobeCritical 9.9
Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.CVE-2026-97801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-96238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-96234 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-96222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95631 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.CVE-2026-95630 · Websites & servers · Adobe · reported by AdobeMedium 4.3
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-92464 · Websites & servers · Adobe · reported by AdobeCritical 9.1
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.CVE-2026-88132 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
- Product
- azure-keyvault-administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.CVE-2026-83926 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.CVE-2026-83728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.CVE-2026-70213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
- Product
- Microsoft Power Apps for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-70194 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
- Product
- .NET 11.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.