Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

323new WordPress flaws this week

393,460entries in the database

17,662 results · page 140 of 354

Mar 2, 2026Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with AutCVE-2026-3338 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Product
AWS-LC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com github.com
Mar 2, 2026Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing anaCVE-2026-3337 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.2
Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Product
AWS-LC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com github.com
Mar 2, 2026Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objectCVE-2026-3336 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.
Product
AWS-LC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com github.com
Mar 2, 2026In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error.CVE-2025-48636 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com
Mar 2, 2026DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result iCVE-2025-14532 · Other software · Studio Fabryka · reported by cvd@cert.plCritical 9.3
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
Product
DobryCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Mar 2, 2026U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on thCVE-2026-3422 · Other software · e-Excellence · reported by twcert@cert.org.twCritical 9.3
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
Product
U-Office Force
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Mar 2, 2026IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to dCVE-2026-3000 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
Product
IDExpert Windows Logon Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record changingtec.com twcert.org.tw
Mar 2, 2026IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to dCVE-2026-2999 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
Product
IDExpert Windows Logon Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record changingtec.com twcert.org.tw
Feb 28, 2026Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers: WpForo 2.4.14 contains an unauthenticated SQL injectionCVE-2026-28562 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
Product
Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers
What to do
Update Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the gCVE-2026-28559 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_aCVE-2026-28554 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 27, 2026osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theCVE-2019-25497 · Websites & servers · Oscommerce · reported by VulnCheckHigh 8.8
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the currency parameter. Attackers can send GET requests to shopping_cart.php with malicious currency values using boolean-based SQL injection payloads to extract sensitive database information.
Product
osCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com oscommerce.com
Feb 27, 2026osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theCVE-2019-25496 · Websites & servers · Oscommerce · reported by VulnCheckHigh 8.8
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the products_id parameter. Attackers can modify the products_id value in product_info.php requests and append boolean-based SQL injection payloads to extract sensitive database information.
Product
osCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com oscommerce.com
Feb 27, 2026osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through theCVE-2019-25495 · Websites & servers · Oscommerce · reported by VulnCheckHigh 8.8
osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the reviews_id parameter. Attackers can send GET requests to product_reviews_write.php with malicious reviews_id values using boolean-based SQL injection payloads to extract sensitive database information.
Product
osCommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com oscommerce.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injectiCVE-2019-25494 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'valCVE-2019-25493 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter. Attackers can send GET requests to the admin/getrecord.php endpoint with malicious 'val' values to extract sensitive database information.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt'CVE-2019-25492 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter. Attackers can send GET requests to the admin/getcmsdata.php endpoint with malicious 'pt' values to extract sensitive database information.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catiCVE-2019-25491 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive database information.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' CVE-2019-25490 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hostiCVE-2019-25489 · Other software · Doditsolutions · reported by VulnCheckHigh 8.8
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service.
Product
Homey BNB (Airbnb Clone Script)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doditsolutions.com exploit-db.com
Feb 27, 2026Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD aCVE-2026-21659 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.7
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.
Product
Frick Controls Quantum HD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov johnsoncontrols.com
Feb 27, 2026Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to CVE-2026-2251 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fCritical 9.8
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads https://www.support.xerox.com/en-us/product/core/downloads
Product
FreeFlow Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitydocs.business.xerox.com
Feb 27, 2026Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD CVE-2026-21658 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 8.8
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Product
Frick Controls Quantum HD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov johnsoncontrols.com
Feb 26, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc.CVE-2026-24498 · Other software · EFM-Networks, Inc. · reported by vuln@krcert.or.krMedium 6
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc. IpTIME T5008, EFM-Networks, Inc. IpTIME AX2004M, EFM-Networks, Inc. IpTIME AX3000Q, EFM-Networks, Inc. IpTIME AX6000M allows Authentication Bypass.This issue affects ipTIME T5008: through 15.26.8; ipTIME AX2004M: through 15.26.8; ipTIME AX3000Q: through 15.26.8; ipTIME AX6000M: through 15.26.8.
Product
ipTIME T5008
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record iptime.com boho.or.kr
Feb 26, 2026An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, anCVE-2026-22877 · Other software · Copeland · reported by ics-cert@hq.dhs.govLow 3.7
An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack.
Product
Copeland XWEB 300D PRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com webapps.copeland.com
Feb 26, 2026A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a CVE-2026-20797 · Other software · Copeland · reported by ics-cert@hq.dhs.govMedium 4.3
A stack based buffer overflow exists in an API route of XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to cause stack corruption and a termination of the program.
Product
Copeland XWEB 300D PRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com webapps.copeland.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27028 · Other software · Mobility46 · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
mobility46.se
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Feb 26, 2026An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on thCVE-2026-24663 · Other software · Copeland · reported by ics-cert@hq.dhs.govCritical 9
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
Product
Copeland XWEB 300D PRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com webapps.copeland.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27772 · Other software · EV Energy · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
ev.energy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27767 · Other software · SWITCH EV · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
swtchenergy.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com swtchenergy.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-25851 · Other software · Chargemap · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
chargemap.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chargemap.com github.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-24731 · Other software · EV2GO · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
ev2go.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ev2go.io github.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-20781 · Other software · CloudCharge · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Product
cloudcharge.se
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudcharge.tech github.com
Feb 26, 2026OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT prCVE-2026-22207 · Other software · Volcengine · reported by VulnCheckCritical 9.3
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.
Product
OpenViking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 26, 2026SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protectCVE-2026-22205 · Other software · SPIP · reported by VulnCheckHigh 8.7
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
Product
SPIP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spip.net git.spip.net
Feb 25, 2026The Events Calendar: Unauthorized modification of data and loss of dataCVE-2026-2694 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
Product
The Events Calendar
Affected
up to 6.15.16
What to do
Affects up to 6.15.16. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated uCVE-2026-1725 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.3
GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record about.gitlab.com gitlab.com
Feb 25, 2026Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCVE-2026-20133 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
Product
Catalyst SD-WAN Manager
On CISA’s list since
Apr 20, 2026 (federal fix deadline Apr 23, 2026)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com cisa.gov
Feb 25, 2026A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected syCVE-2026-20129 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. 
Product
Cisco Catalyst SD-WAN Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Feb 25, 2026A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condCVE-2026-20033 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation when processing specific Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to the management interface of an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. Note: Only the out-of-band (OOB) management interface is affected.
Product
Cisco NX-OS System Software in ACI Mode
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Feb 25, 2026A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP CVE-2026-20010 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP process to restart, which could cause an affected device to reload unexpectedly. This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol).
Product
Cisco NX-OS Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Feb 25, 2026Post Duplicator: Unauthorized arbitrary protected post meta insertionCVE-2026-2301 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys on duplicated posts via the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` REST API endpoint.
Product
Post Duplicator
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026WP Recipe Maker: Unauthorized access of dataCVE-2025-14742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_get_recipe' functions in all versions up to, and including, 10.2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive recipe information including draft, pending, and private recipes that they shouldn't be able to access.
Product
WP Recipe Maker
Affected
up to 10.2.3
What to do
Affects up to 10.2.3. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026WPGSI: Spreadsheet Integration: Unauthorized modification and loss of dataCVE-2026-1916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_callBackFuncUpdate` REST API functions in all versions up to, and including, 3.8.3. Both REST endpoints use `permission_callback => '__return_true'`, allowing unauthenticated access. The plugin's custom token-based validation relies on a Base64-encoded JSON object containing the user ID and email address, but is not cryptographically signed. This makes it possible for unauthenticated attackers to forge tokens using publicly enumerable information (admin user ID and email) to create, modify, and delete arbitrary WordPress posts and pages, granted they know the administrator's email address and an active integration ID with remote updates enabled.
Product
WPGSI: Spreadsheet Integration
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update WPGSI: Spreadsheet Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 24, 2026The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pCVE-2026-27744 · Other software · SPIP · reported by VulnCheckCritical 9.3
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
Product
tickets
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spip.net chocapikk.com
Feb 24, 2026The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimCVE-2026-27743 · Other software · SPIP · reported by VulnCheckCritical 9.3
The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.
Product
referer_spam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.spip.net chocapikk.com
Feb 24, 2026CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogsCVE-2026-2914 · Other software · CyberArk Software, a Palo Alto Networks Company · reported by psirt@paloaltonetworks.comHigh 8.5
CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs
Product
Endpoint Privilege Manager Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cyberark.com cyberark.com
Feb 24, 2026A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution.CVE-2025-46320 · Other software · Claris · reported by product-security@apple.comMedium 6.1
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
Product
FileMaker Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.claris.com
Feb 24, 2026NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command.CVE-2025-33179 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successful exploit of this vulnerability might lead to escalation of privileges.
Product
Cumulus Linux GA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvd.nist.gov nvidia.custhelp.com
Feb 24, 2026Responsive Lightbox & Gallery: Is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious linkCVE-2025-15386 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Product
Responsive Lightbox & Gallery
Fixed in
2.6.1
What to do
Update Responsive Lightbox & Gallery to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.