Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,512 results · page 11 of 91
Aug 3, 2026OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or CVE-2026-39931 · Other software · openemr · reported by VulnCheckHigh 8.6
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjivasecurity.comvulncheck.com
Aug 3, 2026GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through maliCVE-2026-69097 · Other software · gitpython-developers · reported by VulnCheckHigh 7.3
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
- Product
- GitPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 3, 2026Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration cCVE-2026-69093 · Other software · Admidio · reported by VulnCheckHigh 7.1
Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlCVE-2026-62416 · Other software · Sharp Corporation · reported by vultures@jpcert.or.jpMedium 6.9
Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and upload files unlimitedly. This may cause a denial-of-service (DoS) condition on the PC. Furthermore, if a malicious file is uploaded, a PC user may be tricked to execute the file to attack other entities from that PC.
- Product
- Network Scanner Tool Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.jp.sharpglobal.sharp
Aug 2, 2026RT Mega Menu: Does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin pageCVE-2026-15385 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
- Product
- RT Mega Menu
- Fixed in
- 1.5.2
- What to do
- Update RT Mega Menu to 1.5.2 or newer.
Jul 31, 2026HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities.CVE-2026-56567 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.1
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
- Product
- HCL iControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 31, 2026ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authenticatiCVE-2026-65310 · Other software · ANDRITZ · reported by office@cyberdanube.comHigh 7.5
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.
- Product
- HIPASE-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration.CVE-2026-56428 · Other software · Bosch · reported by psirt@bosch.comHigh 8.1
The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance.
- Product
- BSH ELP (Electronic Platform) Modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subseqCVE-2026-7849 · Other software · Phoenix Contact · reported by info@cert.vde.comCritical 9.3
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sysCVE-2026-44099 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.5
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resultCVE-2026-44095 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.5
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials.CVE-2026-44094 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.3
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration.CVE-2026-44091 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.8
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Fluent Forms: Does not sanitise and escape one of its form field configuration settings before outputting it inside an inline scriptCVE-2026-11881 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
- Product
- Fluent Forms
- Fixed in
- 6.2.6
- What to do
- Update Fluent Forms to 6.2.6 or newer.
Jul 29, 2026Logging operator automates the deployment and configuration of Kubernetes logging pipelines.CVE-2026-54680 · Other software · kube-logging · reported by GitHubCritical 9.9
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
- Product
- logging-operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of CVE-2026-15228 · Other software · reported by 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbHigh 7.1
Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables.CVE-2026-56389 · Other software · GNU · reported by cvd@cert.plMedium 6.8
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
- Product
- Bison
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plcgit.git.savannah.gnu.org
Jul 29, 2026Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.CVE-2026-58164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.3
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / CVE-2026-67178 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.8
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configured destination URL. Because the destination did not end with /, attacker-controlled path content was appended directly to the hostname rather than to its URL path. For example, a request resembling: http://misp.example/@attacker.example/ could result in a redirect resembling: https://misp.example@attacker.example/ Under standard URL parsing, misp.example is interpreted as user information and attacker.example as the destination host. An unauthenticated remote attacker could therefore construct a URL hosted under the legitimate MISP domain that redirects users to an attacker-controlled website. The vulnerability could be used for phishing, credential collection, or potentially disclosing sensitive query-string information preserved during the redirect. Exploitation requires a user to follow the crafted HTTP URL. The fix adds the missing trailing slash to the redirect destination, en
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the exteCVE-2026-65881 · Websites & servers · reported by security@joomla.orgHigh 7.5
Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started.CVE-2026-62429 · Other software · Xen · reported by security@xen.orgMedium 6.5
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
- Product
- Xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxenbits.xenproject.orgopenwall.com
Jul 28, 2026Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file.CVE-2026-41874 · Other software · OpenSolution · reported by cvd@cert.plMedium 6.8
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. Only version 6.7 was tested but all versions should be considered as vulnerable.
- Product
- Quick.Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plopensolution.org
Jul 28, 2026A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gainiCVE-2026-14168 · Other software · ads-tec Industrial IT · reported by info@cert.vde.comHigh 8.8
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.
- Product
- DVG-IRF1401
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrCVE-2026-14167 · Other software · ads-tec Industrial IT · reported by info@cert.vde.comHigh 8.7
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.
- Product
- DVG-IRF1401
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arCVE-2026-64537 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccm_tx_work_expired() re-arms itself via queue_delayed_work() using the configured exp_interval converted by interval_to_us(). When exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range, interval_to_us() returns 0, causing the worker to fire immediately in a tight loop that allocates skbs until OOM. Fix this by validating exp_interval at configuration time: - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the netlink policy so userspace cannot set an invalid value. - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has not yet been configured (defaults to 0 from kzalloc).
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 27, 2026phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT CVE-2026-66398 · Other software · thorsten · reported by VulnCheckCritical 9.4
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 27, 2026Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attackeCVE-2025-59181 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 4.8
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.
- Product
- Packet Core Controller (PCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowCVE-2025-59178 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 4.8
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.
- Product
- Packet Core Controller (PCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically cCVE-2025-59177 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 6.8
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
- Product
- Ericsson Packet Core Controller (PCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessibleCVE-2026-55985 · Other software · Tycon Systems · reported by ics-cert@hq.dhs.govMedium 5.3
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.
- Product
- TPDIN-Monitor-WEB2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations CVE-2026-64252 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the initial console output handler from a kernel thread other than the initial one will result in a situation where the stack has been placed in the XKPHYS 64-bit memory segment and consequently so has been the buffer allocated there that is used as the argument corresponding to the `%s' output conversion specifier for the firmware's printf() entry point. This 64-bit address will then be truncated by 32-bit firmware, resulting in an attempt to access the wrong memory location, which in turn will cause all kinds of unpredictable behaviour, such as a kernel crash: Console: colour dummy device 160x64 Calibrating delay loop... 49.36 BogoMIPS (lpj=192512) pid_max: default: 32768 minimum: 301 CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800 Oops[#1]: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121 $ 0 : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0 $ 4 : 000000000203
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 24, 2026Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypCVE-2026-66005 · Other software · janhq · reported by VulnCheckMedium 5.3
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.
- Product
- jan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64CVE-2026-12504 · Other software · Loytec · reported by vulnerability@ncsc.chHigh 8.4
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
- Product
- LIP-ME20xC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attaCVE-2026-48539 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers CVE-2026-48538 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers tCVE-2026-48537 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers toCVE-2026-48536 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers tCVE-2026-48535 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arCVE-2026-48534 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attaCVE-2026-48532 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to injeCVE-2026-48531 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to CVE-2026-48530 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
- Product
- GFI Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.conCVE-2026-65895 · Other software · getgrav · reported by VulnCheckHigh 8.2
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configurationCVE-2026-64811 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationCVE-2026-64807 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
- Product
- WebStorm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by defaultCVE-2026-64800 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.5
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
- Product
- GoLand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.CVE-2026-65756 · Websites & servers · reported by security@joomla.orgMedium 6.1
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.CVE-2024-58023 · Other software · Bosch · reported by psirt@bosch.comHigh 8.4
Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information.
- Product
- Bosch Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload mCVE-2026-13184 · Other software · Progress Software · reported by security@progress.comHigh 7.5
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
- Product
- Telerik UI for ASP.NET AJAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the requireCVE-2026-63141 · Other software · Elastic · reported by security@elastic.coMedium 6.3
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.