Updated 51 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

391,288 results · page 11 of 7826

Oct 30, 2026Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownCVE-2026-119564 · Other software · Plausible · reported by VulnCheckMedium 6
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
Product
Plausible Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped taCVE-2026-119563 · Websites & servers · phpMyAdmin · reported by VulnCheckMedium 5.1
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attributCVE-2026-119562 · Websites & servers · phpMyAdmin · reported by VulnCheckLow 2.3
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__central_columns INSERT and UPDATE queries run with controluser privileges, reading or modifying other users' configuration-storage data.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn asserCVE-2026-119561 · Websites & servers · phpMyAdmin · reported by VulnCheckHigh 7.6
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech abraxaslabs.tech
Oct 30, 2026OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlinCVE-2026-119560 · Other software · opnsense · reported by VulnCheckMedium 6
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificatCVE-2026-119559 · Other software · litespeedtech · reported by VulnCheckHigh 8.2
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
Product
openlitespeed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points aftCVE-2026-119558 · Other software · OpenCart · reported by VulnCheckLow 2.3
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Product
OpenCart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary DatabrickCVE-2026-119557 · Other software · n8n-io · reported by VulnCheckHigh 8.2
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can supply ../ sequences and query strings via webhook, chat, or form inputs mapped to spaceId, indexName, or filePath to read secrets using the stored credential.
Product
n8n
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_getCVE-2026-119556 · Other software · Moodle Project · reported by VulnCheckMedium 5.3
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the coCVE-2026-119555 · Other software · Moodle Project · reported by VulnCheckMedium 5.3
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External databaseCVE-2026-119554 · Other software · Moodle Project · reported by VulnCheckMedium 6
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash-quote payload in idnumber that executes during scheduled sync on MySQL/MariaDB external databases, reading data and manipulating enrolment results.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard questCVE-2026-119553 · Other software · Moodle Project · reported by VulnCheckHigh 7.1
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional adminCVE-2026-119552 · Other software · louislam · reported by VulnCheckMedium 6.3
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Product
uptime-kuma
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users tCVE-2026-119551 · Other software · jellyfin · reported by VulnCheckHigh 7.1
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Product
jellyfin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDCVE-2026-119550 · Other software · jellyfin · reported by VulnCheckMedium 5.1
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from unfiltered playlist ItemIds and then stream that hidden media.
Product
jellyfin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compresseCVE-2026-119549 · Other software · jellyfin · reported by VulnCheckHigh 7.1
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Product
jellyfin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another orCVE-2026-119548 · Other software · getlago · reported by VulnCheckLow 2.3
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Product
lago
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that CVE-2026-119547 · Other software · forgejo · reported by VulnCheckMedium 5.3
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
Product
forgejo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech codeberg.org
Oct 30, 2026Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read CVE-2026-119546 · Other software · forgejo · reported by VulnCheckMedium 6.8
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
Product
forgejo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech codeberg.org
Oct 30, 2026Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attacCVE-2026-119545 · Other software · forgejo · reported by VulnCheckMedium 6.9
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
Product
forgejo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech codeberg.org
Oct 30, 2026phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting tCVE-2026-119429 · Websites & servers · phpMyAdmin · reported by VulnCheckMedium 5.3
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/vaCVE-2026-119428 · Websites & servers · phpMyAdmin · reported by VulnCheckMedium 6.3
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encoCVE-2026-119427 · Websites & servers · phpMyAdmin · reported by VulnCheckLow 2.3
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checkCVE-2026-119426 · Websites & servers · phpMyAdmin · reported by VulnCheckHigh 7.7
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hiCVE-2026-119425 · Other software · opnsense · reported by VulnCheckMedium 5.3
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directiCVE-2026-119424 · Other software · opnsense · reported by VulnCheckMedium 6.1
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by CVE-2026-119423 · Other software · opnsense · reported by VulnCheckMedium 6.9
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because CVE-2026-119422 · Other software · juspay · reported by VulnCheckHigh 8.2
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without enforced mTLS. Attackers knowing the merchant_id and Worldpay orderCode can POST unsigned XML with lastEvent SETTLED to the worldpayxml webhook endpoint, marking unpaid payments as charged or triggering refund, dispute and payout events.
Product
hyperswitch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confCVE-2026-119421 · Other software · juspay · reported by VulnCheckHigh 8.2
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Product
hyperswitch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via tCVE-2026-119420 · Other software · getlago · reported by VulnCheckHigh 8.7
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
Product
lago
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression CVE-2026-119419 · Other software · cakephp · reported by VulnCheckCritical 9.2
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
Product
cakephp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindoCVE-2026-119418 · Other software · cakephp · reported by VulnCheckCritical 9.2
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
Product
cakephp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTCVE-2026-119417 · Other software · cakephp · reported by VulnCheckMedium 6.3
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.
Product
cakephp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive aCVE-2026-119416 · Other software · cakephp · reported by VulnCheckMedium 6.3
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
Product
cakephp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type aCVE-2026-119415 · Other software · cakephp · reported by VulnCheckMedium 6.3
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.
Product
cakephp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers toCVE-2026-119414 · Other software · bitwarden · reported by VulnCheckMedium 5.3
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administrative, to inject vault items synced to read-only or inaccessible collections' members.
Product
server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as rooCVE-2026-119409 · Other software · opnsense · reported by VulnCheckHigh 8.6
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
Product
core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChaCVE-2026-119408 · Other software · n8n-io · reported by VulnCheckHigh 8.7
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
Product
n8n
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers tCVE-2026-119407 · Other software · element-hq · reported by VulnCheckHigh 7.1
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Product
element-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corruptCVE-2026-119379 · Other software · SQLite · reported by VulnCheckHigh 8.5
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulCVE-2026-119378 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column.CVE-2026-119377 · Other software · SQLite · reported by VulnCheckLow 2
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix opeCVE-2026-119376 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file withCVE-2026-119375 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafteCVE-2026-119374 · Other software · SQLite · reported by VulnCheckHigh 8.5
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix CVE-2026-119373 · Other software · SQLite · reported by VulnCheckHigh 8.5
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cacCVE-2026-119372 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table exCVE-2026-119371 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WCVE-2026-119364 · Other software · ProFTPD Project · reported by VulnCheckMedium 6
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.
Product
ProFTPD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destinatiCVE-2026-119147 · Other software · ProFTPD Project · reported by VulnCheckMedium 5.3
ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.
Product
ProFTPD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.