Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,444 results · page 11 of 149
Sep 8, 2026In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code.CVE-2026-28658 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy.CVE-2026-28657 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack.CVE-2026-28656 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code.CVE-2026-28655 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check.CVE-2026-28652 · Computers, phones & browsers · Google · reported by security@android.comLow 3.1
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code.CVE-2026-28650 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy.CVE-2026-28644 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code.CVE-2026-28642 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code.CVE-2026-28638 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.CVE-2026-28636 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code.CVE-2026-28634 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion.CVE-2026-28633 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack.CVE-2026-28631 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection .CVE-2026-28626 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check.CVE-2026-28623 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass.CVE-2026-28622 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion.CVE-2026-28617 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy.CVE-2026-28614 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation.CVE-2026-28613 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code.CVE-2026-28612 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check.CVE-2026-28611 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code.CVE-2026-28606 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy.CVE-2026-28603 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code.CVE-2026-28602 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy.CVE-2026-28600 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code.CVE-2026-28599 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion.CVE-2026-28596 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI.CVE-2026-28593 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code.CVE-2026-28584 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permissiCVE-2026-28582 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code.CVE-2026-0084 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due tCVE-2026-0065 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered tCVE-2026-81824 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.3
The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.
- Product
- Pipeline Integrity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavascrCVE-2026-78838 · Other software · reported by MITREMedium 6.5
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 8, 2026NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirectsCVE-2026-86550 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.5
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.
- Product
- NebulaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A security flaw has been discovered in java-json-tools jackson-coreutils 2.0.CVE-2026-86513 · Other software · java-json-tools · reported by VulDBMedium 5.5
A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jackson-coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was identified in java-json-tools json-patch up to 1.13.CVE-2026-86512 · Other software · java-json-tools · reported by VulDBLow 2.1
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- json-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was found in java-json-tools jackson-coreutils 2.0.CVE-2026-86511 · Other software · java-json-tools · reported by VulDBMedium 5.5
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability is the function BigDecimal.toPlainString of the file src/main/java/com/github/fge/jackson/JacksonUtils.java. Performing a manipulation results in resource consumption. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jackson-coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system.CVE-2026-66768 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.
- Product
- SAP NetWeaver (SAP GUI for Java)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability was found in java-json-tools jackson-coreutils 2.0.CVE-2026-86321 · Other software · java-json-tools · reported by VulDBMedium 5.5
A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jackson-coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A vulnerability has been found in java-json-tools json-patch up to 1.13.CVE-2026-86319 · Other software · java-json-tools · reported by VulDBMedium 5.5
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- json-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A flaw has been found in java-json-tools json-patch up to 1.13.CVE-2026-86318 · Other software · java-json-tools · reported by VulDBMedium 5.5
A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- json-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaSCVE-2026-78325 · Other software · Standard Notes · reported by b2fa7fcc-7d08-41f0-853b-11242c5539dbMedium 6.9
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
- Product
- Standard Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to CVE-2026-86315 · Computers, phones & browsers · Samsung Opensource · reported by PSIRT@samsung.comMedium 6.2
An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other uCVE-2026-86188 · Other software · WWBN · reported by VulnCheckMedium 6.9
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 5, 2026Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checkCVE-2026-86185 · Other software · Bilibili · reported by VulnCheckHigh 8.6
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
- Product
- Bilibili Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.bilibili.comgithub.com
Sep 4, 2026Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed CVE-2026-85786 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.
- Product
- ion-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Sep 4, 2026Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScrCVE-2026-9317 · Other software · NangoHQ · reported by VulnCheckCritical 9.2
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
- Product
- nango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as aCVE-2026-84469 · Other software · fastify · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 7.5
fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handler on any request. An unauthenticated remote client can therefore reach a handler that a valid deny-all schema was intended to make unreachable, a complete validation bypass that can lead to unauthorized state changes or execution of disabled operations. Users should upgrade to fastify 5.12.2 or later.
- Product
- fastify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 3, 2026A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards.CVE-2026-84185 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
- Product
- Red Hat Ansible Automation Platform 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.