Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,551 results · page 11 of 212
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15664 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
- Product
- Ultimate Before After Image Slider & Gallery
- Fixed in
- 4.7.19
- What to do
- Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15663 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
- Product
- Ultimate Before After Image Slider & Gallery
- Fixed in
- 4.7.19
- What to do
- Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Sep 1, 2026Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers.CVE-2026-84694 · Other software · coollabsio · reported by VulnCheckHigh 8.7
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.CVE-2026-81928 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgmetacpan.org
Sep 1, 2026WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly vCVE-2026-84482 · Other software · WWBN · reported by VulnCheckHigh 8.7
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input.CVE-2026-73750 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.
- Product
- AOS-CX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly ConCVE-2026-78606 · Other software · Elastic · reported by security@elastic.coMedium 4.2
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entries.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly ConstraCVE-2026-78597 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1)CVE-2026-72641 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACVE-2026-72633 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was found in hyperledger-firefly firefly up to 1.4.0.CVE-2026-82957 · Other software · hyperledger-firefly · reported by VulDBMedium 5.5
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- firefly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep.CVE-2026-19953 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements.CVE-2026-19873 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.metacpan.org
Aug 31, 2026@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies.CVE-2026-82856 · Other software · hulumi · reported by VulnCheckCritical 9.3
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.
- Product
- policies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 31, 2026The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.CVE-2026-82838 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.4
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
- Product
- venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions.CVE-2026-82654 · Other software · siyuan-note · reported by VulnCheckCritical 9.3
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 30, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :argsCVE-2026-78038 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.
- Product
- ash_oban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 29, 2026Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path nCVE-2026-82460 · Other software · coderaiser · reported by VulnCheckCritical 9.3
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
- Product
- cloudcmd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate paCVE-2026-80725 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp") loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) t
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 29, 2026WP Ultimate CSV Importer: Does not properly sanitise and escape imported field values before using them in a SQL statementCVE-2026-80488 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
- Product
- WP Ultimate CSV Importer
- Fixed in
- 9.0
- What to do
- Update WP Ultimate CSV Importer to 9.0 or newer.
Aug 29, 2026User Profile Builder: Does not properly restrict its front-end file upload featureCVE-2026-76548 · WordPress plugins & themes · reported by WPScanHigh 8.2
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Aug 28, 2026IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to CVE-2025-36290 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
- Product
- Integrated Analytics System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github.CVE-2026-82289 · Other software · coderamp-labs · reported by VulnCheckHigh 8.3
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.
- Product
- gitingest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in CVE-2026-82281 · Other software · Cinnamon · reported by VulnCheckCritical 9.1
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
- Product
- kotaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessiCVE-2026-82272 · Other software · immich-app · reported by VulnCheckHigh 7.1
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection.
- Product
- immich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conCVE-2026-82271 · Other software · SciPhi-AI · reported by VulnCheckHigh 7.1
R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users' conversation histories, corrupting state and injecting malicious content.
- Product
- R2R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads.CVE-2026-82256 · Other software · sveltejs · reported by VulnCheckMedium 6.9
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 28, 2026User Frontend: Does not properly validate field type definitions and deserialises user-controlled post metadataCVE-2026-14558 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- Product
- User Frontend
- Fixed in
- 4.3.10
- What to do
- Update User Frontend to 4.3.10 or newer.
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
- Product
- Shared Files WordPress plugin before 1.7.67, shared-files-pro
- Fixed in
- 1.7.67
- What to do
- Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Aug 27, 2026Partition interceptor may be improperly added while sending message.CVE-2026-59305 · Other software · Spring · reported by security@vmware.comLow 3.1
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
- Product
- Spring Cloud Stream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Dynamic destination cache size is not properly bound in Spring Cloud Stream.CVE-2026-59303 · Other software · Spring · reported by security@vmware.comLow 3.1
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
- Product
- Spring Cloud Stream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory aCVE-2026-81699 · Other software · jahlives · reported by VulnCheckHigh 8.7
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs.CVE-2026-64896 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 5.2
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.
- Product
- T2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter.CVE-2026-81668 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.
- Product
- Red Hat Satellite 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 27, 2026Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint.CVE-2026-81662 · Other software · flowintel · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.6
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0
- Product
- flowintel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by CVE-2026-17562 · Other software · Summit Security Systems · reported by iletisim@usom.gov.trMedium 6.5
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
- Product
- AdisyonPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user.CVE-2026-79654 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.
- Product
- Red Hat Satellite 6.16 for RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not properly verify that a customer portal session has completed its confirmation step before returning dataCVE-2026-77758 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.1
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Aug 26, 2026Eventin: Does not properly restrictCVE-2026-77694 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- Product
- Eventin
- Fixed in
- 4.1.19
- What to do
- Update Eventin to 4.1.19 or newer.
Aug 25, 2026ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution.CVE-2026-80138 · Other software · MacWarrior · reported by VulnCheckCritical 9.2
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge CVE-2026-78655 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record in the session, raising it on each rejected code and deleting the pending record once it reaches attempts, five by default. Punk::Session carries the session in a signed cookie unless the application declares a store, and keeps no server-side record, so an earlier value of the same session stays valid until the expiry stamped inside it. A client that saves the cookie before its failed attempts and presents it again gets the pending record back with its counter, and the limit never fires. The replayed record is accepted while its own expiry, pending_ttl seconds from the challenge and 300 by default, has not passed. Sessions declared with a store are not affected: the pending record and its counter then live server-side. The attempt limit does not bound guessing of the second factor, which is left to the per-address rate limit the plugin registers on the same path, 30 requests per 60 secon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user idenCVE-2026-78619 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly ConstraCVE-2026-78581 · Other software · Elastic · reported by security@elastic.coMedium 4.2
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after tCVE-2026-79664 · Other software · lin-snow · reported by VulnCheckCritical 9.1
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.
- Product
- Ech0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 25, 2026vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path.CVE-2026-78684 · Other software · vllm-project · reported by VulnCheckMedium 6.9
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension fails to properly sanitize user input before using it in a database query.CVE-2026-77137 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.7
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
- Product
- Extension "Forms Export"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with CVE-2026-77130 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 5.3
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
- Product
- Extension "SYSSY - TYPO3 Monitoring & Security Checks"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float.CVE-2026-78183 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL. This can be reached by the $dbh->quote method, for example $dbh->quote( "Infinity", DBI::SQL_NUMERIC ). This regression was introduced in 3.21.0 by the quote.c rewrite.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey.CVE-2026-19565 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eLow 3.7
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. CreateSession calls it with an empty key source on every login, and the optional Keysource directive is the only route to the other branch. The result is 64 hex characters. The microsecond field of the first reading takes one of a million values, the later readings follow it within microseconds, and the process id is drawn from a small range. The key is returned to the browser as the session cookie, and is combined with the configured server key to compute the session id and to encrypt the stored session data. An attacker who knows the second in which a session was created and the process id of the worker that created it can enumerate candidate keys and recover the victim's cookie, bypassing authentication for the protected resources. Each candidate has to be tried against the server, which validates the cookie with a key the attacker does not hold.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 23, 2026Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.CVE-2026-75922 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way. Everything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.