Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,805 results · page 11 of 157
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102999 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102998 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102997 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102996 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102995 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102994 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-102993 · Other software · py-pdf · reported by GitHubHigh 8.7
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Mako is a template library written in Python.CVE-2026-102991 · Other software · sqlalchemy · reported by GitHubMedium 6.5
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.
- Product
- mako
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-102376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
- Affected
- up to 3.4.32
- What to do
- Affects up to 3.4.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled searCVE-2026-47570 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.
- Product
- GeForce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 30, 2026NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type confusion.CVE-2026-47504 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.
- Product
- GeForce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possibleCVE-2026-100280 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentialsCVE-2026-100279 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' commentsCVE-2026-100278 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.9
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signatureCVE-2026-100277 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.9
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the actionCVE-2026-100276 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possibleCVE-2026-100275 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification templateCVE-2026-100274 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionCVE-2026-100273 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issuesCVE-2026-100272 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.9
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projectsCVE-2026-100271 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurationsCVE-2026-100270 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.3
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedCVE-2026-100269 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templatesCVE-2026-100268 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filtersCVE-2026-100267 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted addressCVE-2026-100266 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.7
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmationCVE-2026-100265 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
- Product
- Rider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server hostCVE-2026-100264 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possibleCVE-2026-100263 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templatesCVE-2026-100262 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.6
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permissionCVE-2026-100261 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password resetCVE-2026-100260 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only accessCVE-2026-100259 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settingsCVE-2026-100258 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF exportCVE-2026-100257 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projectsCVE-2026-100256 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetCVE-2026-100255 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connCVE-2026-100254 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSLCVE-2026-100253 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Satori is a library to convert HTML and CSS to SVG.CVE-2026-94545 · Other software · vercel · reported by GitHubMedium 5.3
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
- Product
- satori
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.CVE-2026-97293 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
- Affected
- up to 3.41
- What to do
- Affects up to 3.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Apache MINA SSHD is a Java library for client-side and server-side SSH.CVE-2026-93994 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
- Product
- Apache MINA SSHD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 30, 2026Media Library Organizer: Does not verify that the requesting user holds the target taxonomy's management capability before creating a new termCVE-2026-94297 · WordPress plugins & themes · reported by WPScanLow 2.7
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
- Product
- Media Library Organizer
- Fixed in
- 2.1.4
- What to do
- Update Media Library Organizer to 2.1.4 or newer.
Sep 29, 2026An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library CVE-2026-81842 · Other software · Grafana · reported by security@grafana.comMedium 4.3
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.
- Product
- Grafana Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Russh is a Rust SSH client and server library.CVE-2026-102825 · Other software · Eugeny · reported by GitHubLow 3.7
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Russh is a Rust SSH client and server library.CVE-2026-102824 · Other software · Eugeny · reported by GitHubMedium 4.3
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret, forcing the X25519 contribution to the combined shared secret to zero. A malicious SSH peer can therefore make the combined secret depend only on ML-KEM, defeating the hybrid exchange's intended fallback protection if ML-KEM is later weakened. This issue is fixed in version 0.63.0.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Russh is a Rust SSH client and server library.CVE-2026-102823 · Other software · Eugeny · reported by GitHubHigh 7.5
Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Russh is a Rust SSH client and server library.CVE-2026-102822 · Other software · Eugeny · reported by GitHubLow 3.7
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task. This issue is fixed in version 0.63.1.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Russh is a Rust SSH client and server library.CVE-2026-102821 · Other software · Eugeny · reported by GitHubMedium 6.5
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress prevents priority_receiver in russh/src/server/session.rs from being drained. The server continues processing network input and enqueues a ChannelOpenReply for each request on an unbounded channel, allowing one connection to grow memory until the process is terminated. This issue is fixed in version 0.63.2.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileCVE-2026-102639 · Other software · MobilityDB · reported by VulnCheckHigh 7.1
MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative length value wraps to a large unsigned size_t due to missing signed validation, bypasses an overflow-unsafe pointer arithmetic bounds check in wkb_parse_state_check(), and causes memcpy() in text_from_wkb_state() to operate with a corrupted unbounded length, resulting in a remote denial-of-service condition affecting all sessions on the PostgreSQL instance.
- Product
- MobilityDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.