Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31,419 results · page 13 of 629
Oct 19, 2026IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2026-6719 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting.CVE-2026-4413 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.CVE-2026-4405 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.CVE-2026-3628 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not CVE-2026-3303 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatioCVE-2026-3161 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Cloud Pak System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.CVE-2026-1510 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.7
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.CVE-2026-1501 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid EvCVE-2026-112377 · Other software · CCC-Attestation · reported by VulnCheckCritical 9.1
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
- Product
- attested-tls-poc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Oct 19, 2026IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.CVE-2026-6930 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written CVE-2026-15661 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
- Product
- Concert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applCVE-2026-14511 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during cCVE-2026-12670 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and CVE-2026-12669 · Other software · IBM · reported by psirt@us.ibm.comLow 3.1
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
- Product
- MQ Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch rCVE-2026-112366 · Other software · micromatch · reported by VulnCheckHigh 8.7
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.
- Product
- picomatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass CVE-2026-112363 · Other software · unclecode · reported by VulnCheckMedium 6.9
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.
- Product
- crawl4ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources becaCVE-2026-112308 · Other software · crewAIInc · reported by VulnCheckHigh 8.3
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
- Product
- crewai-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped doCVE-2026-112307 · Other software · andialbrecht · reported by VulnCheckHigh 8.4
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
- Product
- sqlparse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassiCVE-2026-112306 · Other software · nocobase · reported by VulnCheckHigh 8.6
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables CVE-2026-112305 · Other software · semaphoreui · reported by VulnCheckHigh 8.7
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
- Product
- Semaphore UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=TruCVE-2026-112304 · Other software · Mindee · reported by VulnCheckHigh 7.7
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
- Product
- docTR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controCVE-2026-112303 · Other software · GDevelop · reported by VulnCheckMedium 5.3
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
- Product
- GDevelop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the CVE-2026-107571 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mCVE-2026-107569 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve redirect, vacation or notify, a bounce, an out-of-office reply - by a counter it carries in the message's X-hMailServer-LoopCount header, and makes no more once the counter reaches the configured rule loop limit (5 by default); that is what ends a forwarding or auto-reply cycle in a bounded number of hops. X-hMailServer-LoopCount is an ordinary header that is not stripped from mail arriving from outside, and the server read it with a signed conversion and no validation, so a count below zero passed every test against the limit: a sender who sets X-hMailServer-LoopCount to a negative value, or on the Linux builds to a value above the 32-bit signed range that the conversion wraps to a negative one, lifts the bound, and a message that enters a generated-mail cycle then loops up to about two thousand million times, each hop a queued message and a delivery, filling the queue and disk and stopping mail
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServerCVE-2026-107568 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine,
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail theyCVE-2026-107567 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.5
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DK
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive RoCVE-2026-107566 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script's editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script's header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message's first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account's address, or anyone's at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain's DKIM key, a forgery aligned to pass the domain's DMARC; or, where another sender's domain is one the server signs for, delete the DKIM-Signature that sender's message arrived with, alter a field, and redirect, so the server re-signed th
- Product
- hMailServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via CVE-2026-112296 · Other software · sunkaifei · reported by VulnCheckCritical 9.3
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
- Product
- FlyCms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extCVE-2026-112295 · Other software · sunkaifei · reported by VulnCheckMedium 5.3
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
- Product
- FlyCms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' CVE-2026-112294 · Other software · sunkaifei · reported by VulnCheckMedium 5.3
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
- Product
- FlyCms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payCVE-2026-112293 · Other software · BoxyHQ · reported by VulnCheckMedium 5.3
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
- Product
- saas-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PCVE-2026-112292 · Computers, phones & browsers · operacle · reported by VulnCheckCritical 9.3
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
- Product
- checkcle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles renderedCVE-2026-112289 · Other software · KoalixSwitzerland · reported by VulnCheckMedium 5.1
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.
- Product
- koalixcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an CVE-2026-112284 · Other software · xqq · reported by VulnCheckMedium 4.8
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.
- Product
- libaribcaption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_poCVE-2026-112283 · Other software · VideoLAN · reported by VulnCheckMedium 6.8
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
- Product
- libbluray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.videolan.orghackmd.io
Oct 19, 2026VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a CVE-2026-112282 · Other software · VideoLAN · reported by VulnCheckMedium 6.8
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.
- Product
- libbluray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.videolan.orghackmd.io
Oct 19, 2026libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write CVE-2026-112281 · Other software · nkoriyama · reported by VulnCheckMedium 6.9
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.
- Product
- aribb24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversCVE-2026-112280 · Other software · nkoriyama · reported by VulnCheckMedium 6.9
libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.
- Product
- aribb24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients viCVE-2026-112279 · Other software · rdesktop · reported by VulnCheckHigh 7.1
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
- Product
- rdesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clientsCVE-2026-112278 · Other software · rdesktop · reported by VulnCheckHigh 7.1
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
- Product
- rdesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by senCVE-2026-112277 · Other software · rdesktop · reported by VulnCheckHigh 7.1
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
- Product
- rdesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles witCVE-2026-112276 · Other software · Netpbm · reported by VulnCheckMedium 6.9
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent heap bytes into the PNM output or crash the program.
- Product
- Netpbm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackmd.ionetpbm.sourceforge.net
Oct 19, 2026Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/raCVE-2026-112275 · Other software · Netpbm · reported by VulnCheckMedium 6.9
Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md_image, causing memory corruption and crashes.
- Product
- Netpbm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackmd.ionetpbm.sourceforge.net
Oct 19, 2026libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SCVE-2026-112274 · Other software · libtins · reported by VulnCheckMedium 6.3
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.
- Product
- libtins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buCVE-2026-112273 · Other software · libtins · reported by VulnCheckMedium 6.9
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority records trigger a one-byte read when parsed, crashing applications on hardened allocators.
- Product
- libtins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block'sCVE-2026-112271 · Other software · emersion · reported by VulnCheckMedium 6.8
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
- Product
- libdisplay-info
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.orggitlab.freedesktop.org
Oct 19, 2026SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthCVE-2026-112270 · Other software · sgl-project · reported by VulnCheckHigh 7.1
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowinCVE-2026-112269 · Other software · sgl-project · reported by VulnCheckHigh 7.1
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA mCVE-2026-112268 · Other software · sgl-project · reported by VulnCheckMedium 5.3
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
- Product
- sglang-router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to triggeCVE-2026-112267 · Other software · sgl-project · reported by VulnCheckMedium 6.9
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.