Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,546 results · page 155 of 771
May 12, 2026Improper Input Validation vulnerability in Apache Tomcat.CVE-2026-41293 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 12, 2026The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component.CVE-2026-31228 · Other software · Red Hat · reported by MITRECritical 9.8
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.
- Product
- Red Hat OpenShift AI (RHOAI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS CVE-2026-31226 · Other software · reported by MITRECritical 9.8
The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system() without proper input sanitization or escaping. User-controlled input (such as file paths) is directly interpolated into shell command strings using f-strings within the _copy() function. An attacker can inject arbitrary OS commands by supplying a specially crafted path parameter through the Hydra configuration framework. This leads to remote code execution with the privileges of the user running the TinyZero training process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submittedCVE-2026-31220 · Other software · reported by MITRECritical 9.8
PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submitted code. The system allows low-privileged users to submit Python functions (via @sy.syft_function()) for remote execution on the server. While a code approval mechanism exists, the submitted code undergoes no security checks for dangerous operations (e.g., file access, command execution). Once approved, the code is executed within the server process using exec() and eval() functions without proper isolation. A remote attacker can leverage this to execute arbitrary Python code on the server, leading to complete compromise of the server environment.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) allowsCVE-2026-31217 · Other software · Nebuly · reported by MITRECritical 9.8
The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) allows arbitrary code execution. When a user supplies a directory path via the --model command-line argument, the function reads a module.py file from that directory and executes its contents directly using Python's exec() function. This design does not validate or sanitize the file's content, allowing an attacker who controls the input directory to execute arbitrary Python code in the context of the process running the script.
- Product
- Optimate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API.CVE-2026-31216 · Other software · Nexent · reported by MITRECritical 9.1
The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{object_name:path} endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send crafted requests with a user-controlled object_name path parameter to delete arbitrary files from the underlying MinIO storage system. Successful exploitation leads to data loss and denial of service.
- Product
- Nexent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.CVE-2026-31215 · Other software · Nexent · reported by MITRECritical 9.1
The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{index_name}/documents endpoint lacks proper authentication and authorization controls and does not validate the user-supplied path_or_url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and corresponding files from the MinIO storage system. Successful exploitation leads to data destruction and denial of service.
- Product
- Nexent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deseriaCVE-2026-31214 · Other software · reported by MITRECritical 9.8
The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deserialization vulnerability (CWE-502). The script uses torch.load() to process PyTorch checkpoint files (.pt) without enabling the security-restrictive weights_only=True parameter. This oversight allows the deserialization of arbitrary Python objects via the pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution in the context of the user running the script.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access.CVE-2026-30805 · Other software · Pandora FMS · reported by security@pandorafms.comCritical 9.1
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Sandbox escape in the Profile Backup component.CVE-2026-8401 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 12, 2026External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTMCVE-2026-8043 · Network & remote access · ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 9.6
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- Product
- Xtraction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.CVE-2026-45091 · Other software · davidalmeidac · reported by GitHubCritical 9.1
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
- Product
- sealed-env
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board.CVE-2026-8072 · Other software · Ingeteam · reported by cve-coordination@incibe.esCritical 9.2
Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.
- Product
- Ingecon Sun EMS Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esreversemode.com
May 12, 2026Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default pCVE-2026-7428 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.2
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required network access to the AlloyDB cluster and was limited to Terraform or the REST API, as other clients blocked it.
- Product
- AlloyDB for PostgreSQL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026A vulnerability has been identified in ROS# (All versions < V2.2.2).CVE-2026-41551 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized. This could allow a remote attacker to access arbitrary files on the device.
- Product
- ROS#
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
May 12, 2026Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface.CVE-2026-25787 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
May 12, 2026Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.CVE-2026-25786 · Other software · Siemens · reported by productcert@siemens.comCritical 9.3
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
May 12, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd.CVE-2025-6577 · Websites & servers · Akilli Commerce Software Technologies Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection. This issue affects E-Commerce Website: before 4.5.001.
- Product
- E-Commerce Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026"Kura Sushi Official App" provided by EPG, Inc.CVE-2026-41872 · Other software · EPG, Inc. · reported by vultures@jpcert.or.jpCritical 9.1
"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.
- Product
- "Kura Sushi Official App" for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary seCVE-2026-34263 · Websites & servers · SAP_SE · reported by cna@sap.comCritical 9.6
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
- Product
- SAP Commerce cloud configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements thrCVE-2026-34260 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.
- Product
- SAP S/4HANA (SAP Enterprise Search for ABAP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026TanStack Unspecified VulnerabilityCVE-2026-45321 · Other software · TanStack · reported by GitHubExploitedRansomwareCritical 9.6
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
- Product
- TanStack
- On CISA’s list since
- May 27, 2026 (federal fix deadline Jun 10, 2026)
- What to do
- Attackers are using this now. Install TanStack’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
May 11, 2026DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.CVE-2026-43900 · Other software · ThinkInAIXYZ · reported by GitHubCritical 9.3
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., javascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.
- Product
- deepchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.CVE-2026-43899 · Other software · ThinkInAIXYZ · reported by GitHubCritical 9.6
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.
- Product
- deepchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026oxyno-zeta/s3-proxy is an aws s3 proxy written in go.CVE-2026-42882 · Other software · oxyno-zeta · reported by GitHubCritical 9.4
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns that match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a pr
- Product
- s3-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.CVE-2026-42869 · Other software · socfortress · reported by GitHubCritical 10
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.
- Product
- CoPilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026FireFighter is an incident management application.CVE-2026-42864 · Other software · ManoManoTech · reported by GitHubCritical 9.9
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = [permissions.AllowAny]). Its attachments payload is fetched server-side via httpx.get() with no URL validation, then uploaded as an attachment on the Jira ticket that gets created. An unauthenticated caller able to reach the ingress can coerce the pod into fetching arbitrary URLs and exfiltrate the response as a Jira attachment. On EC2/EKS deployments that do not enforce IMDSv2, this allows theft of the temporary AWS credentials attached to the pod's IAM role. The docstring on the view claims a Bearer token is required, but the code does not enforce it. This vulnerability is fixed in 0.0.54.
- Product
- firefighter-incident
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.CVE-2026-38567 · Other software · reported by MITRECritical 9.8
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.CVE-2026-7813 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 9.4
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs. Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner's record. Fix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manage
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Angular Expressions provides expressions for the Angular.JS web framework as a standalone module.CVE-2026-44643 · Other software · peerigon · reported by GitHubCritical 9.3
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. This vulnerability is fixed in 1.5.2.
- Product
- angular-expressions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Grav is a file-based Web platform.CVE-2026-42613 · Other software · getgrav · reported by GitHubCritical 9.4
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are included in the configured allowed fields list, an unauthenticated user can self-register with admin.super privileges by injecting these fields into the registration request. This vulnerability is fixed in 2.0.0-beta.2.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Grav is a file-based Web platform.CVE-2026-42607 · Other software · getgrav · reported by GitHubCritical 9.1
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file uploads, it fails to inspect the contents of uploaded ZIP archives. Once a malicious plugin is extracted, it can execute arbitrary PHP code or drop a persistent web shell on the server. This vulnerability is fixed in 2.0.0-beta.2.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability.CVE-2026-40636 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
- Product
- ECS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2026WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload maCVE-2021-47940 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX fileupload action. Attackers can send POST requests to the admin-ajax.php endpoint with the download_from_files_617_fileupload action, manipulating the allowExt parameter to bypass file type restrictions and upload executable files like PHP shells to the web root.
- Affected
- up to 1.48
- What to do
- Affects up to 1.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP filCVE-2021-47936 · Other software · Opencats · reported by VulnCheckCritical 9.3
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.
- Product
- OpenCATS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 10, 2026WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requeCVE-2021-47933 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submittiCVE-2021-47932 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie.CVE-2021-47923 · Other software · Opencart · reported by VulnCheckCritical 9.3
OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.
- Product
- opencart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comopencart.com
May 10, 2026In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism storeCVE-2026-6722 · Websites & servers · PHP Group · reported by security@php.netCritical 9.5
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 9, 2026ArchiveBox is an open source self-hosted web archiving system.CVE-2026-42601 · Other software · ArchiveBox · reported by GitHubCritical 9.3
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. At time of publication, there are no publicly available patches.
- Product
- ArchiveBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Pelican is a platform for creating data federations.CVE-2026-42571 · Other software · PelicanPlatform · reported by GitHubCritical 9
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI). This attack allows any user authenticated to the WebUI via OAuth to gain admin privileges under certain configurations. This issue has been patched in versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2.
- Product
- pelican
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026phpVMS is a PHP application to run and simulate an airline.CVE-2026-42569 · Websites & servers · phpvms · reported by GitHubCritical 9.4
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
- Product
- phpvms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026auth provides authentication via oauth2, direct and email.CVE-2026-42560 · Other software · go-pkgz · reported by GitHubCritical 9.1
auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the Patreon account returned by Patreon. In practice, this means all Patreon-authenticated users of an application using this library are collapsed into a single local identity. Any application that trusts token.User.ID as the stable account key can end up mixing or fully merging unrelated Patreon users, which can lead to cross-account access, privilege confusion, and subscription-state leakage. This issue has been patched in versions 1.25.2 and 2.1.2.
- Product
- auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages.CVE-2026-44313 · Other software · linkwarden · reported by GitHubCritical 9.1
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function allows authenticated users to make arbitrary HTTP requests to internal services due to insufficient URL validation that only checks for "http://" or "https://" prefixes. This issue has been patched in version 2.13.0.
- Product
- linkwarden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.CVE-2026-42454 · Other software · Termix-SSH · reported by GitHubCritical 9.9
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.
- Product
- Termix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Sentry is an error tracking and performance monitoring tool.CVE-2026-42354 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026FastGPT is an AI Agent building platform.CVE-2026-42302 · Other software · labring · reported by GitHubCritical 9.8
FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticated Remote Code Execution (RCE). The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080). This configuration allows any user with network access to the port to bypass authentication and gain full control over the sandbox environment. This issue has been patched in version 4.14.13.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Postiz is an AI social media scheduling tool.CVE-2026-42298 · Other software · gitroomhq · reported by GitHubCritical 10
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-42287 · Other software · emlog · reported by GitHubCritical 10
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Plunk is an open-source email platform built on top of AWS SES.CVE-2026-42193 · Other software · useplunk · reported by GitHubCritical 9.1
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
- Product
- plunk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.