Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,472 results · page 118 of 770
Jul 15, 2026Wekan is open source kanban built with Meteor.CVE-2026-55652 · Other software · wekan · reported by GitHubCritical 9.8
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.
- Product
- wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript.CVE-2026-55445 · Other software · whyour · reported by GitHubCritical 9.3
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.
- Product
- qinglong
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026WWBN AVideo is an open source video platform.CVE-2026-54458 · Other software · WWBN · reported by GitHubCritical 9.6
WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated r
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Wekan is open source kanban built with Meteor.CVE-2026-52893 · Other software · wekan · reported by GitHubCritical 9.2
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.
- Product
- wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Wekan is open source kanban built with Meteor.CVE-2026-52891 · Other software · wekan · reported by GitHubCritical 9.9
Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the server. This issue is fixed in version 9.07.
- Product
- wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.CVE-2026-30623 · Other software · reported by MITRECritical 9.8
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.litellm.aigithub.com
Jul 15, 2026xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling.CVE-2026-30618 · Other software · reported by MITRECritical 9.8
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modificatiCVE-2026-26718 · Other software · reported by MITRECritical 9.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comxxl-job-admin.com
Jul 15, 2026An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.CVE-2025-65720 · Other software · reported by MITRECritical 9.8
An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.CVE-2026-54052 · Other software · czlonkowski · reported by GitHubCritical 9.9
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.
- Product
- n8n-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-52887 · Other software · nocobase · reported by GitHubCritical 10
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remoCVE-2026-51380 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 20269Router is an AI router & token saver.CVE-2026-49352 · Other software · decolua · reported by GitHubCritical 9.8
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44
- Product
- 9router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 20269Router is an AI router & token saver.CVE-2026-46339 · Other software · decolua · reported by GitHubCritical 10
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
- Product
- 9router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cilium is a networking, observability, and security solution.CVE-2026-49445 · Other software · cilium · reported by GitHubCritical 9.2
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.14, 1.18.8, and 1.19.2.
- Product
- cilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-46684 · Other software · dataease · reported by GitHubCritical 9.5
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45534 · Other software · dataease · reported by GitHubCritical 9
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext so com.amazon.redshift.Driver#connect, com.amazon.redshift.Driver#getJdbcIniFile, and com.amazon.redshift.util.ObjectFactory#instantiate execute a reflection-based remote code execution chain during a normal JDBC connection through io.dataease.datasource.type.Redshift. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database servCVE-2026-46421 · Other software · cap-js · reported by GitHubCritical 9.3
The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-service@2.10.1` were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. User should upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials. No known workarounds are available.
- Product
- @cap-js/sqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026OpenWrt is a Linux operating system targeting embedded devices.CVE-2026-62948 · Other software · openwrt · reported by GitHubCritical 9.6
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
- Product
- openwrt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Better Auth is an authentication and authorization library for TypeScript.CVE-2026-53513 · Other software · better-auth · reported by GitHubCritical 9.6
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.
- Product
- better-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Better Auth is an authentication and authorization library for TypeScript.CVE-2026-53512 · Other software · better-auth · reported by GitHubCritical 9.1
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
- Product
- better-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-50562 · Other software · labring · reported by GitHubCritical 9.3
FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface.CVE-2026-14960 · Other software · Pegatron Corp. · reported by cret@cert.orgCritical 9.8
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.
- Product
- Tdelo64.sys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026RustFS Console is a web management console for the RustFS distributed file system.CVE-2026-62378 · Other software · rustfs · reported by GitHubCritical 9
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.
- Product
- console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52843 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Lightpanda is a headless browser designed for AI and automation.CVE-2026-52842 · Other software · lightpanda-io · reported by GitHubCritical 9.3
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.
- Product
- browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Metabase is an open-source business intelligence and embedded analytics tool.CVE-2026-50148 · Other software · metabase · reported by GitHubCritical 10
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
- Product
- metabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Penpot is an open-source design tool for design and code collaboration.CVE-2026-44986 · Other software · penpot · reported by GitHubCritical 9.9
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.
- Product
- penpot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-61740 · Other software · HKUDS · reported by GitHubCritical 9.3
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, /auth-status and /login can mint guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can call endpoints guarded by combined_auth, including document read, upload, deletion, graph mutation, and query endpoints. This vulnerability is fixed in 1.5.4.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026LightRAG provides simple and fast retrieval-augmented generation.CVE-2026-61736 · Other software · HKUDS · reported by GitHubCritical 9.3
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.
- Product
- LightRAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture vCVE-2026-42533 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-passCVE-2026-61451 · Other software · getgrav · reported by VulnCheckCritical 9.4
The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers.
- Product
- grav-plugin-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests toCVE-2026-56400 · Other software · open-webui · reported by VulnCheckCritical 9
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 14, 2026An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user tCVE-2026-13385 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.5
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet proCVE-2026-5270 · Other software · CIENA · reported by 7bd90cf1-1651-495e-9ae8-9415fb3c9febCritical 9.8
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
- Product
- Navigator NCS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations.CVE-2026-5269 · Other software · CIENA · reported by 7bd90cf1-1651-495e-9ae8-9415fb3c9febCritical 9.8
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.
- Product
- Navigator NCS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_CVE-2026-51808 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounCVE-2026-51807 · Other software · reported by MITRECritical 9.8
Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentiaCVE-2026-48334 · Other software · Adobe · reported by AdobeCritical 9.3
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard.CVE-2026-45363 · Other software · jwt · reported by GitHubCritical 9.1
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.
- Product
- ruby-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/UpCVE-2026-38450 · Other software · reported by MITRECritical 9.8
An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeslam3kl.gitbook.ioeslam3kl.gitbook.io
Jul 14, 2026The decompress package for Node.js extracts archives.CVE-2026-53486 · Other software · XhmikosR · reported by GitHubCritical 9.1
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.
- Product
- decompress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upCVE-2026-52101 · Other software · reported by MITRECritical 9.1
An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-48327 · Websites & servers · Adobe · reported by AdobeCritical 9
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-48325 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary cCVE-2026-48324 · Websites & servers · Adobe · reported by AdobeCritical 9.1
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the contexCVE-2026-48322 · Websites & servers · Adobe · reported by AdobeCritical 9.9
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.CVE-2026-48321 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code exCVE-2026-48319 · Websites & servers · Adobe · reported by AdobeCritical 9.1
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file systCVE-2026-48318 · Websites & servers · Adobe · reported by AdobeCritical 9.9
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.