Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,539 results · page 153 of 771
May 14, 2026FileBrowser Quantum is a free, self-hosted, web-based file manager.CVE-2026-44542 · Other software · gtsteffaniak · reported by GitHubCritical 9.1
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
- Product
- filebrowser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.CVE-2026-41615 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Authenticator for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Valtimo is an open-source business process automation platform.CVE-2026-42555 · Other software · valtimo-platform · reported by GitHubCritical 9.1
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.
- Product
- valtimo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCVE-2026-20182 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
- Product
- Catalyst SD-WAN
- On CISA’s list since
- May 14, 2026 (federal fix deadline May 17, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comsec.cloudapps.cisco.com
May 14, 2026Gotenberg is a Docker-powered stateless API for PDF files.CVE-2026-42596 · Other software · gotenberg · reported by GitHubCritical 9.4
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Gotenberg is a Docker-powered stateless API for PDF files.CVE-2026-42589 · Other software · gotenberg · reported by GitHubCritical 9.8
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to ExifTool via the go-exiftool library. No validation is performed on key characters. A \n embedded in a JSON key splits the ExifTool stdin stream into a new argument line, allowing an attacker to inject arbitrary ExifTool flags — including -if, which evaluates Perl expressions. This achieves unauthenticated OS command execution in a single HTTP request. The response is HTTP 200 with a valid PDF, making the attack transparent to basic monitoring. This vulnerability is fixed in 8.31.0.
- Product
- gotenberg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026MagicMirror² is an open source modular smart mirror platform.CVE-2026-42281 · Other software · MagicMirrorOrg · reported by GitHubCritical 9.2
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
- Product
- MagicMirror
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026PyTorch Lightning is a deep learning framework to pretrain and finetune AI models.CVE-2026-44484 · Other software · Lightning-AI · reported by GitHubCritical 9.3
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
- Product
- pytorch-lightning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 14, 2026soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support.CVE-2026-44482 · Other software · richardhbtz · reported by GitHubCritical 9.6
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.
- Product
- soundcloud-rpc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing.CVE-2026-42457 · Other software · loft-sh · reported by GitHubCritical 9
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context. In the worst case, a malicious user could potentially create a new Global-Admin user, bypassing other security restrictions. The attacker needs the ability to create namespaces. This vulnerability is fixed in 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0.
- Product
- loft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2026-2347 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2025-11024 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Blind SQL Injection. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026InfusedWoo Pro: Authorization bypassCVE-2026-6512 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.
- Product
- InfusedWoo Pro
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update InfusedWoo Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.infusedwoo.comwordfence.com
May 14, 2026InfusedWoo Pro: Privilege escalationCVE-2026-6510 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies for any targeted user account (e.g., administrator), achieving complete authentication bypass and privilege escalation.
- Product
- InfusedWoo Pro
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update InfusedWoo Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwoo.infusedaddons.comwordfence.com
May 14, 2026Career Section: Arbitrary File UploadCVE-2026-6271 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Career Section plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7 via the CV upload handler. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Product
- Career Section
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Career Section to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2026Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative): Authentication BypassCVE-2026-8181 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
- Product
- Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)
- Affected
- 3.4.0 to 3.4.1.1
- What to do
- Affects 3.4.0 to 3.4.1.1. Update Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
May 13, 2026Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.CVE-2026-8500 · Other software · EVANK · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command. The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.
- Product
- Web::Passwd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgmetacpan.org
May 13, 2026OPNsense is a FreeBSD based firewall and routing platform.CVE-2026-45158 · Other software · opnsense · reported by GitHubCritical 9.1
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ERPNext is a free and open source Enterprise Resource Planning tool.CVE-2026-44442 · Other software · frappe · reported by GitHubCritical 9.9
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026OPNsense is a FreeBSD based firewall and routing platform.CVE-2026-44194 · Other software · opnsense · reported by GitHubCritical 9.1
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026OPNsense is a FreeBSD based firewall and routing platform.CVE-2026-44193 · Other software · opnsense · reported by GitHubCritical 9.1
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CubeCart is an ecommerce software solution.CVE-2026-45714 · Other software · cubecart · reported by GitHubCritical 9.1
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Invoices, Documents, and Contact Forms). The application unsafely evaluates user-supplied input using the Smarty template engine without enabling Smarty Security Policies. This allows any authenticated user with administrative privileges to execute arbitrary operating system commands (RCE) on the server. This vulnerability is fixed in 6.7.0.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CubeCart is an ecommerce software solution.CVE-2026-45053 · Other software · cubecart · reported by GitHubCritical 9.1
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026MISP is an open source threat intelligence and sharing platform.CVE-2026-44381 · Other software · MISP · reported by GitHubCritical 9.3
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name. An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact. This vulnerability is fixed in 2.5.37.
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026CubeCart is an ecommerce software solution.CVE-2026-44377 · Other software · cubecart · reported by GitHubCritical 9.1
CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates and Documents). The application unsafely evaluates user-supplied input directly through the Smarty template engine. By leveraging this, an authenticated attacker with administrative privileges can bypass current restrictions and call native PHP functions within the templates, such as readgzfile() to read sensitive configuration files, or error_log() to write a malicious PHP web shell, ultimately achieving Information Disclosure and full Remote Code Execution (RCE). This vulnerability is fixed in 6.7.0.
- Product
- v6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.CVE-2025-27851 · Other software · Garmin · reported by MITRECritical 9.3
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
- Product
- Empirbus Wireless Display Unit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgarmin.comwww8.garmin.com
May 13, 2026MISP modules are autonomous modules that can be used to extend MISP for new services.CVE-2026-44364 · Other software · MISP · reported by GitHubCritical 9.3
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.
- Product
- misp-modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026fast-jwt provides fast JSON Web Token (JWT) implementation.CVE-2026-44351 · Other software · nearform · reported by GitHubCritical 9.1
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string (''), for example via the common keys[decoded.header.kid] || '' JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = ['HS256','HS384','HS512'] from it, and then verifies the token's signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key='', input='${header}.${payload}'), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.
- Product
- fast-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-45411 · Other software · patriksimek · reported by GitHubCritical 9.8
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-44009 · Other software · patriksimek · reported by GitHubCritical 9.8
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-44008 · Other software · patriksimek · reported by GitHubCritical 9.8
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-44007 · Other software · patriksimek · reported by GitHubCritical 9.1
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-44006 · Other software · patriksimek · reported by GitHubCritical 10
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-44005 · Other software · patriksimek · reported by GitHubCritical 10
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-43999 · Other software · patriksimek · reported by GitHubCritical 9.9
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like child_process and achieve remote code execution. This vulnerability is fixed in 3.11.0.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026vm2 is an open source vm/sandbox for Node.js.CVE-2026-43997 · Other software · patriksimek · reported by GitHubCritical 10
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
- Product
- vm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.CVE-2026-42945 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.f5.comdepthfirst.com
May 13, 2026Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key uCVE-2020-37168 · Websites & servers · Paiement · reported by VulnCheckCritical 9.3
Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.
- Product
- Ecommerce Systempay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpaiement.systempay.frpaiement.systempay.fr
May 13, 2026ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter.CVE-2026-42062 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.3
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
- Product
- WRC-BE72XSD-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.CVE-2026-40621 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpCritical 9.3
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
- Product
- WRC-BE72XSD-B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repositoryCVE-2026-41050 · Other software · SUSE · reported by meissner@suse.deCritical 9.9
Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
May 13, 2026Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version).CVE-2026-32661 · Other software · Canon Marketing Japan Inc. · reported by vultures@jpcert.or.jpCritical 9.3
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd with grdnwww user privilege.
- Product
- GUARDIANWALL MailSuite (On-premises version)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurity-support.canon-its.jp
May 13, 2026Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution wheCVE-2025-11159 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comCritical 9.1
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.
- Product
- Pentaho Data Integration and Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-44547 · Other software · ChurchCRM · reported by GitHubCritical 9.6
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-42288 · Other software · ChurchCRM · reported by GitHubCritical 10
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Thymeleaf is a server-side Java template engine for web and standalone environments.CVE-2026-41901 · Other software · thymeleaf · reported by GitHubCritical 9
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
- Product
- thymeleaf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Scramble generates API documentation for Laravel project.CVE-2026-44262 · Other software · dedoc · reported by GitHubCritical 9.4
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
- Product
- scramble
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026efw4.X is an Enterprise Framework for Web.CVE-2026-44258 · Other software · efwGrp · reported by GitHubCritical 9.3
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
- Product
- efw4.X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026efw4.X is an Enterprise Framework for Web.CVE-2026-44257 · Other software · efwGrp · reported by GitHubCritical 9.3
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.
- Product
- efw4.X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026wger is a free, open-source workout and fitness manager.CVE-2026-43948 · Other software · wger-project · reported by GitHubCritical 9.9
wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage_gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. This vulnerability is fixed in 2.6.
- Product
- wger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.