Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,766 results · page 10 of 36
Mar 27, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33765 · Other software · pi-hole · reported by GitHubHigh 8.9
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an attacker can append arbitrary system commands to the intended pihole command. Furthermore, because the command is executed with sudo privileges, the injected commands will run with elevated (likely root) privileges. Version 6.0 patches the issue.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.CVE-2026-33742 · Other software · invoiceninja · reported by GitHubMedium 5.4
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output.
- Product
- invoiceninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.CVE-2026-33628 · Other software · invoiceninja · reported by GitHubMedium 5.4
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
- Product
- invoiceninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026WPCargo Track & Trace: Missing AuthorizationCVE-2026-25401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2026solidtime is an open-source time-tracking app.CVE-2026-33345 · Other software · solidtime-io · reported by GitHubMedium 6.5
solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.
- Product
- solidtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33417 · Other software · ellite · reported by GitHubMedium 6.5
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33407 · Other software · ellite · reported by GitHubHigh 8.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_PROXY environment variables without validation, enabling SSRF via proxy hijacking. The server performs DNS resolution on user-supplied search terms, which can be controlled by attackers to trigger outbound requests to arbitrary domains. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33401 · Other software · ellite · reported by GitHubHigh 7.1
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE-2026-30840) added SSRF protection to notification test endpoints but left three additional attack surfaces unprotected: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job. An authenticated user can reach internal network services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS), or localhost-bound services by supplying a crafted URL to any of these endpoints. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33400 · Other software · ellite · reported by GitHubMedium 5.4
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-33399 · Other software · ellite · reported by GitHubHigh 7.7
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Spoofing issue in the Privacy: Anti-Tracking component.CVE-2026-4728 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 23, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-33548 · Other software · mantisbt · reported by GitHubHigh 8.6
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping `$this->tag_name` in a string_html_specialchars() call in IssueTagTimelineEvent::html().
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-33517 · Other software · mantisbt · reported by GitHubHigh 8.6
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12335be9 and/or manually editing language files to remove the sprintf placeholder `%1$s` from `$s_tag_delete_message` string.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-30849 · Other software · mantisbt · reported by GitHubCritical 9.3
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
- Product
- mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026iTracker360: Cross-Site Request Forgery leading to Stored Cross-Site ScriptingCVE-2026-3572 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0. This is due to missing nonce verification on the settings form submission and insufficient input sanitization combined with missing output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
- Product
- iTracker360
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update iTracker360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful vCVE-2026-31836 · Other software · bluewave-labs · reported by GitHubHigh 8.1
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026CM Custom Reports – Flexible reporting to track what matters most: Stored Cross-Site ScriptingCVE-2026-2432 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CM Custom Reports – Flexible reporting to track what matters most
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update CM Custom Reports – Flexible reporting to track what matters most to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 17, 2026Sentry is a developer-first error tracking and performance monitoring tool.CVE-2026-26004 · Other software · getsentry · reported by GitHubMedium 5.7
Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) vulnerability in Sentry's GroupEventJsonView endpoint. Version 26.1.0 patches the issue.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026AdGuard Home is a network-wide software for blocking ads and tracking.CVE-2026-32136 · Other software · AdguardTeam · reported by GitHubCritical 9.8
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.
- Product
- AdGuardHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2026-22248 · Other software · glpi-project · reported by GitHubHigh 8
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30842 · Other software · ellite · reported by GitHubMedium 4.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30841 · Other software · ellite · reported by GitHubMedium 6.9
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30840 · Other software · ellite · reported by GitHubHigh 8.8
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notification testers. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30839 · Other software · ellite · reported by GitHubMedium 5.3
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL against private/reserved IP ranges, enabling full-read SSRF. The server response is returned to the caller. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful vCVE-2026-30829 · Other software · bluewave-labs · reported by GitHubMedium 5.3
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.
- Product
- Checkmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-30828 · Other software · ellite · reported by GitHubHigh 8.7
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through thCVE-2018-25192 · Other software · Sourceforge · reported by VulnCheckHigh 8.8
GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit crafted POST requests to the login.php endpoint with SQL injection payloads in the username field to gain unauthorized access without valid credentials.
- Product
- GPS Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 6, 2026Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code throCVE-2018-25161 · Other software · Warrantytrack · reported by VulnCheckHigh 8.8
Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code through the txtCustomerCode, txtCustomerName, and txtPhone POST parameters in SearchCustomer.php. Attackers can submit crafted SQL statements using UNION SELECT to extract sensitive database information including usernames, database names, and version details.
- Product
- Warranty Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 6, 2026Kimai is a web-based multi-user time-tracking application.CVE-2026-28685 · Other software · kimai · reported by GitHubMedium 6.5
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activitiesCVE-2026-29052 · Other software · humhub · reported by GitHubMedium 6.9
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11.
- Product
- calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Canarytokens help track activity and actions on a network.CVE-2026-28355 · Other software · thinkst · reported by GitHubLow 1.3
Canarytokens help track activity and actions on a network. Versions prior to `sha-7ff0e12` have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can insert Javascript into the title field of their PWA token. When the creator later browses the installation page for their own Canarytoken, the Javascript executes. This is a self-XSS. An attacker could create a Canarytoken with this self-XSS, and send the install link to a victim. When they click on it, the Javascript would execute. However, no sensitive information (ex. session information) will be disclosed to the malicious actor. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-7ff0e12.
- Product
- canarytokens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpointCVE-2026-28193 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Bugsink is a self-hosted error tracking tool.CVE-2026-27614 · Other software · bugsink · reported by GitHubCritical 9.3
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments returns more lines than it was given (a known upstream quirk that triggers with Ruby heredoc-style input), `_pygmentize_lines()` in `theme/templatetags/issues.py:75-77` falls back to returning the raw input lines. `mark_safe()` at line 111-113 is then applied unconditionally - including to those unsanitized raw lines. Since DSN endpoints are public by Sentry protocol, no account is needed to inject. The payload sits in the database until an admin looks at the event. Successful exploitation requires that the attacker to be able to submit events to the project (i.e. knows the DSN or can access a client that uses it), the Bugsink ingest endpoint is reachable to the attacker, and an administrator explicitly views the crafted event in the UI. Under those conditions, the attacker can execute JavaScript in the administrator’s browser and act with that user’s privileges within Bugsink. Version 2.0.1
- Product
- bugsink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorizatiCVE-2026-25649 · Other software · traccar · reported by GitHubHigh 7.3
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorization codes by exploiting an open redirect vulnerability in two OIDC-related endpoints. The `redirect_uri` parameter is not validated against a whitelist, allowing attackers to redirect authorization codes to attacker-controlled URLs, enabling account takeover on any OAuth-integrated application. As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in tCVE-2026-25648 · Other software · traccar · reported by GitHubHigh 8.7
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices CVE-2026-23521 · Other software · traccar · reported by GitHubMedium 6.5
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/sCVE-2025-68930 · Other software · traccar · reported by GitHubHigh 7.1
Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Wallos is an open-source, self-hostable personal subscription tracker.CVE-2026-27479 · Other software · ellite · reported by GitHubHigh 7.7
Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates the IP address of the provided URL before making the request, but allows HTTP redirects (CURLOPT_FOLLOWLOCATION = true), enabling an attacker to bypass the IP validation and access internal resources, including cloud instance metadata endpoints. The getLogoFromUrl() function validates the URL by resolving the hostname and checking if the resulting IP is in a private or reserved range using FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE. However, the subsequent cURL request is configured with CURLOPT_FOLLOWLOCATION = true and CURLOPT_MAXREDIRS = 3, which means the request will follow HTTP redirects without re-validating the destination IP. This issue has been fixed in version 4.6.1.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Sentry is a developer-first error tracking and performance monitoring tool.CVE-2026-27197 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.CVE-2026-2040 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.3
PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability.CVE-2026-2033 · Other software · MLflow · reported by zdi-disclosures@trendmicro.comHigh 7.3
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26649.
- Product
- MLflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Feb 19, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-26953 · Other software · pi-hole · reported by GitHubMedium 5.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery’s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-26952 · Other software · pi-hole · reported by GitHubMedium 5.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. The populateDataTable() function contains a data variable with the full DNS record value exactly as entered by the user and returned by the API. This value is inserted directly into the data-tag HTML attribute without any escaping or sanitization of special characters. When an attacker supplies a value containing double quotes ("), they can prematurely “close” the data-tag attribute and inject additional HTML attributes into the element. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited. This issue has been fixed in version 6.4.1.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Rack is a modular Ruby web server interface.CVE-2026-25500 · Other software · rack · reported by GitHubMedium 5.4
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Rack is a modular Ruby web server interface.CVE-2026-22860 · Other software · rack · reported by GitHubHigh 7.5
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
- Product
- rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.CVE-2026-25676 · Other software · M-Audio · reported by vultures@jpcert.or.jpHigh 7.1
The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrator privileges.
- Product
- M-Track Duo HD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026MMA Call Tracking: Cross-Site Request ForgeryCVE-2026-1215 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is due to missing nonce validation when saving plugin configuration on the `mma_call_tracking_menu` admin page. This makes it possible for unauthenticated attackers to modify call tracking configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MMA Call Tracking
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update MMA Call Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 10, 2026Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted CVE-2025-7347 · Other software · Dinibh Puzzle Software Solutions · reported by iletisim@usom.gov.trHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dinibh Patrol Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 9, 2026In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logsCVE-2026-25846 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and tCVE-2026-22904 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.
- Product
- 0852-1322
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.