Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391,288 results · page 10 of 7826
Oct 30, 2026ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable CVE-2026-119575 · Other software · ArcadeData · reported by VulnCheckHigh 7.1
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1CVE-2026-119574 · Other software · traefik · reported by VulnCheckHigh 8.2
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secrCVE-2026-119573 · Other software · traefik · reported by VulnCheckLow 2.1
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS confiCVE-2026-119572 · Other software · traefik · reported by VulnCheckHigh 7
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation nameCVE-2026-119571 · Other software · parse-community · reported by VulnCheckMedium 6.3
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by CVE-2026-119570 · Other software · parse-community · reported by VulnCheckLow 2.3
Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects CVE-2026-119569 · Other software · parse-community · reported by VulnCheckMedium 6
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026A flaw was found in the Ickle query parser in Infinispan.CVE-2026-119542 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
- Product
- Red Hat build of Apache Camel 4 for Quarkus 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 30, 2026A flaw was found in GIMP.CVE-2026-119528 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 30, 2026CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.CVE-2026-118987 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().CVE-2026-118986 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.CVE-2026-117350 · Other software · reported by MITRE
Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitcoin.combitcoincore.org
Oct 30, 2026Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method.CVE-2026-117028 · Other software · reported by MITRE
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.CVE-2026-115683 · Other software · GNOME · reported by patrick@puiterwijk.orgMedium 6.8
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer d
- Product
- Epiphany
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combeford.net
Oct 30, 2026Kirki: ReCAPTCHA bypassCVE-2026-112348 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
- Product
- Kirki
- Fixed in
- 6.2.5
- What to do
- Update Kirki to 6.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Oct 30, 2026Kirki: Broken object-level access controlCVE-2026-112347 · WordPress plugins & themes · reported by VulnCheckHigh 7.2
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.
- Product
- Kirki
- Fixed in
- 6.4.1
- What to do
- Update Kirki to 6.4.1 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability.CVE-2026-111500 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.CVE-2026-111499 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability.CVE-2026-111498 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Campfire is a web-based chat application.CVE-2026-100355 · Other software · basecamp · reported by GitHubLow 3.1
Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.
- Product
- once-campfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.CVE-2026-91917 · Other software · Dell · reported by security_alert@emc.comHigh 8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.CVE-2026-87768 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop. An attacker who controls the number of seconds added can keep the process busy for as long as they choose.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgopenwall.com
Oct 30, 2026An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a deviceCVE-2026-75882 · Other software · ESET spol. s.r.o. · reported by security@eset.comHigh 8.5
An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.
- Product
- ESET Endpoint Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.CVE-2026-13576 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create paymentsCVE-2026-119038 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow's mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call. A remote attacker who obtains another customer's redirect flow ID can create payments or subscriptions against that customer's mandate.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty.CVE-2026-119037 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature.CVE-2026-119036 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and value pair per leaf, each key carrying the full path to that leaf, and the pairs are then encoded, sorted and joined. A long key holding a long array costs memory proportional to the key length times the array length. A remote attacker can exhaust memory in the process receiving webhooks with a single request that carries no valid signature.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.CVE-2026-118996 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right. A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator.CVE-2026-118995 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.CVE-2026-118994 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.CVE-2026-118993 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.CVE-2026-118992 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.4
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.CVE-2026-118991 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.CVE-2026-118990 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route.CVE-2026-118988 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search->find without validation. find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC. Any file the server process can read is reachable. Only POD is rendered, but a file with a POD directive and no "=cut" is POD to the end of the file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request.CVE-2026-116130 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacker can send a path that a proxy or filter checks in full while the application routes on a shorter one.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies.CVE-2026-116128 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read. The data of a large chunk is also held in the buffer until the whole chunk has arrived. A remote attacker can exhaust a worker's memory with a single request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection.CVE-2026-116127 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.CVE-2026-115866 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads. A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.CVE-2026-115865 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 30, 2026FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote CVE-2026-112374 · Other software · FOSSBilling · reported by VulnCheckMedium 5.1
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
- Product
- FOSSBilling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilCVE-2026-111503 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability.CVE-2026-111502 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability.CVE-2026-111501 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks.
- Product
- OpenManage Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a CVE-2026-119591 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
- Product
- SQLite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 30, 2026SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sCVE-2026-119586 · Other software · SQLite · reported by VulnCheckHigh 8.5
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
- Product
- SQLite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 30, 2026vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections CVE-2026-119568 · Other software · vsftpd · reported by VulnCheckCritical 9.1
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
- Product
- vsftpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techsecurity.appspot.com
Oct 30, 2026vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixeCVE-2026-119567 · Other software · vsftpd · reported by VulnCheckLow 2.3
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
- Product
- vsftpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techsecurity.appspot.com
Oct 30, 2026Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_wCVE-2026-119566 · Other software · prometheus · reported by VulnCheckMedium 6.3
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.
- Product
- prometheus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 30, 2026Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassCVE-2026-119565 · Other software · Plausible · reported by VulnCheckMedium 5.3
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
- Product
- Plausible Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.