Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,636 results · page 124 of 353
May 12, 2026Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.CVE-2026-40415 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.CVE-2026-40406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.CVE-2026-40405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.CVE-2026-40402 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.CVE-2026-40379 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.CVE-2026-40374 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-40367 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-40366 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-40364 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-40363 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-40362 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-40361 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-40360 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-40359 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-40358 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-35440 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-35433 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
May 12, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2026-35429 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a networCVE-2026-35424 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.CVE-2026-35423 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.CVE-2026-35421 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network.CVE-2026-34350 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network.
- Product
- Windows Server 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-34329 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to CVE-2026-33833 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
- Product
- Azure Machine Learning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.CVE-2026-32185 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.
- Product
- Microsoft Teams for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-32177 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
May 12, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attackCVE-2026-32161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API.CVE-2026-31216 · Other software · Nexent · reported by MITRECritical 9.1
The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.
- Product
- Nexent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.CVE-2026-31215 · Other software · Nexent · reported by MITRECritical 9.1
The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{index_name}/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied path_or_url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and corresponding files from the MinIO storage system. Successful exploitation leads to data destruction and denial of service.
- Product
- Nexent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.CVE-2026-30807 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.1
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credeCVE-2026-6866 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.2
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
- Product
- EcoStruxure™ Panel Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
May 12, 2026CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files wheCVE-2026-6865 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.1
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
- Product
- EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
May 12, 2026CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑manaCVE-2026-4827 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
- Product
- Easergy MiCOM C264
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
May 12, 2026Smart Appointment & Booking: Unauthorized modification of dataCVE-2026-5693 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic flaw in the saab_cancel_booking() function in all versions up to, and including, 1.0.8. The nonce check uses && (AND) instead of || (OR), which means providing any value for the security parameter causes the entire check to be skipped. This makes it possible for unauthenticated attackers to cancel arbitrary bookings by supplying a predictable booking ID.
- Product
- Smart Appointment & Booking
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Smart Appointment & Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 12, 2026An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling iCVE-2026-35227 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.2
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.
- Product
- CODESYS Modbus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to aCVE-2026-40137 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.
- Product
- Business Server Pages Application (TAF_APPLAUNCHER)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition tCVE-2026-40133 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.
- Product
- SAP S/4HANA Condition Maintenance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary seCVE-2026-34263 · Websites & servers · SAP_SE · reported by cna@sap.comCritical 9.6
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
- Product
- SAP Commerce cloud configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content.CVE-2026-34258 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.
- Product
- SAPUI5 (Search UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthentCVE-2026-27682 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access and/or modify information, impacting the confidentiality and integrity of the application, with no impact to availability.
- Product
- SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026This issue was addressed with improved checks to prevent unauthorized actions.CVE-2026-28974 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a denial-of-service.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2026A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated reCVE-2026-2614 · Other software · mlflow · reported by security@huntr.devHigh 7.5
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
- Product
- mlflow/mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.CVE-2026-5266 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.
- Product
- Echo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
May 11, 2026OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to rCVE-2026-44994 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields. Attackers can access the bootstrap config route without a valid Gateway token to expose sensitive bootstrap and config information intended only for authenticated Control UI sessions.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessCVE-2026-44413 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, andCVE-2026-36962 · Other software · reported by MITREHigh 7.3
SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitee.comthinhneee.github.io
May 11, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.CVE-2026-34093 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 1.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Product
- MediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
May 11, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.CVE-2026-34092 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Product
- MediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
May 11, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.CVE-2026-34091 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 5.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Product
- MediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
May 11, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.CVE-2026-34090 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccMedium 4.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.
- Product
- CheckUser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphabricator.wikimedia.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.