Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,662 results · page 132 of 354
Apr 5, 2026PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'sCVE-2019-25672 · Other software · pilus · reported by VulnCheckHigh 8.8
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to extract sensitive database information.
- Product
- PilusCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netexploit-db.com
Apr 5, 2026News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thrCVE-2019-25668 · Websites & servers · Phpscriptsmall · reported by VulnCheckHigh 8.8
News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the news ID parameter. Attackers can send GET requests to index.php/show/news/ with malicious SQL statements to extract sensitive database information.
- Product
- News Website Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphpscriptsmall.comexploit-db.com
Apr 5, 2026ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thrCVE-2019-25662 · Other software · Montala · reported by VulnCheckHigh 8.8
ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials.
- Product
- ResourceSpace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comresourcespace.com
Apr 4, 2026Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through tCVE-2018-25246 · Other software · Wikipedia · reported by VulnCheckHigh 8.7
Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.
- Product
- Wikipedia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.commicrosoft.com
Apr 4, 2026Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms.CVE-2016-20054 · Other software · nodcms · reported by VulnCheckMedium 5.3
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
- Product
- nodCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2026VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input thrCVE-2018-25241 · Other software · VPNBrowser · reported by VulnCheckHigh 8.7
VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application.
- Product
- VPN Browser+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.commicrosoft.com
Apr 4, 2026Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authCVE-2016-20053 · Other software · Redaxo · reported by VulnCheckMedium 6.9
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
- Product
- Redaxo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Apr 4, 2026Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to thCVE-2016-20052 · Other software · Snewscms · reported by VulnCheckCritical 9.3
Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to the snews_files directory. Attackers can upload malicious PHP files through the multipart form-data upload endpoint and execute them by accessing the uploaded file path to achieve remote code execution.
- Product
- Snews CMS upload sheller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Apr 4, 2026Listeo Core: Unauthenticated arbitrary media uploadCVE-2025-14938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.
- Product
- Listeo Core
- Affected
- up to 2.0.27
- What to do
- Affects up to 2.0.27. Update Listeo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.purethemes.networdfence.com
Apr 4, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Unauthorized membership payment bypassCVE-2026-3445 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.16.11
- What to do
- Affects up to 4.16.11. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 3, 2026Pie Register – User Registration, Profiles & Content Restriction: Unauthorized modification of dataCVE-2026-3571 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registration form status.
- Product
- Pie Register – User Registration, Profiles & Content Restriction
- Affected
- up to 3.8.4.8
- What to do
- Affects up to 3.8.4.8. Update Pie Register – User Registration, Profiles & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 3, 2026ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthCVE-2017-20235 · Other software · ProSoft Technology · reported by VulnCheckCritical 9.3
ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.
- Product
- ICX35-HWC Cellular Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 3, 2026GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access bCVE-2017-20234 · Other software · Belden · reported by VulnCheckCritical 9.3
GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials.
- Product
- GarrettCom Magnum 6K and 10K Managed Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 3, 2026Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthentCVE-2017-20237 · Other software · Belden · reported by VulnCheckCritical 9.3
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.
- Product
- Hirschmann Industrial HiVision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 3, 2026Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-32186 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Bing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.CVE-2026-33107 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Databricks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.CVE-2026-33105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Kubernetes Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-32213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.CVE-2026-32211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Web Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.CVE-2026-32173 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.
- Product
- Azure SRE Agent Gateway - SignalR Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated rCVE-2024-14034 · Other software · Belden · reported by VulnCheckCritical 9.3
Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.
- Product
- Hirschmann HiEOS LRS11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 2, 2026Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to executCVE-2026-5429 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.1
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.
- Product
- Kiro IDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comkiro.dev
Apr 2, 2026Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages.CVE-2026-2699 · Other software · Progress · reported by security@progress.comCritical 9.8
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.sharefile.comgithub.com
Apr 2, 2026An unauthenticated remote attacker can access a configuration file containing database credentials.CVE-2026-33617 · Other software · MB connect line · reported by info@cert.vde.comMedium 5.3
An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.commbconnectline.csaf-tp.certvde.com
Apr 2, 2026An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of spCVE-2026-33616 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.commbconnectline.csaf-tp.certvde.com
Apr 2, 2026An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special CVE-2026-33615 · Other software · MB connect line · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.commbconnectline.csaf-tp.certvde.com
Apr 2, 2026An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special CVE-2026-33614 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.commbconnectline.csaf-tp.certvde.com
Apr 1, 2026An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialCVE-2026-2265 · Other software · Replicator · reported by cret@cert.orgMedium 6.5
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
- Product
- Replicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underCVE-2026-20160 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
- Product
- Cisco Smart Software Manager On-Prem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass aCVE-2026-20093 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a uCVE-2026-20085 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forCVE-2026-20041 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by persuading an authenticated user of the device management interface to click a crafted link. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device to an attacker-controlled server. The attacker could then execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
- Product
- Cisco Nexus Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2026A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitivCVE-2025-67805 · Other software · Sagedpw · reported by MITREMedium 5.9
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 2025_06_003.
- Product
- Sage DPW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comsagedpw.at
Apr 1, 2026OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers toCVE-2026-34999 · Other software · Volcengine · reported by VulnCheckMedium 6.9
OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.
- Product
- OpenViking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by senCVE-2026-29014 · Other software · MetInfo CMS · reported by VulnCheckCritical 9.3
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
- Product
- MetInfo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.commetinfo.cn
Apr 1, 2026Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unaCVE-2026-0932 · Other software · M-Files Corporation · reported by security@m-files.comMedium 6.9
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Apr 1, 2026An improper access check allows unauthorized access to webservice endpoints.CVE-2026-23899 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Order Notification for WooCommerce: Overrides WooCommerce's permission checks to grant full access to all unauthenticated requestsCVE-2025-15484 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
- Product
- Order Notification for WooCommerce
- Fixed in
- 3.6.3
- What to do
- Update Order Notification for WooCommerce to 3.6.3 or newer.
Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 31, 2026XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes.CVE-2025-71278 · Other software · XenForo · reported by VulnCheckHigh 8.7
XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.
- Product
- XenForo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comxenforo.com
Mar 31, 2026The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface.CVE-2026-3356 · Other software · Anritsu · reported by ics-cert@hq.dhs.govCritical 9.3
The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface. Because the device provides no mechanism to enable or configure authentication, the issue is inherent to its design rather than a deployment error.
- Product
- Remote Spectrum Monitor MS27100A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An arbitrary file overwrite vulnerability in Funambol, Inc.CVE-2026-30286 · Other software · Funambol · reported by MITRECritical 9.8
An arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- Zefiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Mar 31, 2026An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import proCVE-2026-30278 · Other software · Funair · reported by MITRECritical 9.8
An arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- FLY IS FUN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfunair.czsecsys.fudan.edu.cn
Mar 31, 2026OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authCVE-2026-34506 · Other software · OpenClaw · reported by VulnCheckLow 2.3
OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during CVE-2026-32977 · Other software · OpenClaw · reported by VulnCheckMedium 5.8
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 31, 2026OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treatCVE-2026-32970 · Other software · OpenClaw · reported by VulnCheckLow 2
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 31, 2026WooPayments: Integrated WooCommerce Payments: Unauthorized modification of dataCVE-2026-1710 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.
- Product
- WooPayments: Integrated WooCommerce Payments
- Affected
- up to 10.5.1
- What to do
- Affects up to 10.5.1. Update WooPayments: Integrated WooCommerce Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 30, 2026The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2.CVE-2026-5130 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any cryptographic validation or authorization checks. The cookie value was used to override the determine_current_user filter, which allowed unauthenticated attackers to impersonate any user by simply setting the cookie to their target user ID. This made it possible for unauthenticated attackers to gain administrator-level access and perform any privileged actions including creating new administrator accounts, modifying site content, installing plugins, or taking complete control of the WordPress site. The vulnerability was fixed in version 1.4.0 by implementing a cryptographic token-based validation system where only administrators can initiate user simulation, and the cookie contains a random 64-character token that must be validated against database-stored mappings rather than accepting arbitrary user IDs.
- Affected
- up to 1.3.2
- Fixed in
- 1.4.0
- What to do
- Update the plugin to 1.4.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 30, 2026A weakness has been identified in YunaiV yudao-cloud up to 2026.01.CVE-2026-5148 · Other software · YunaiV · reported by VulDBLow 2
A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01.CVE-2026-5147 · Other software · YunaiV · reported by VulDBMedium 5.5
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.