Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,513 results · page 17 of 391
Oct 14, 2026holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tCVE-2026-110769 · Other software · holaboss-ai · reported by VulnCheckHigh 8.3
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
- Product
- holaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rCVE-2026-110768 · Other software · holaboss-ai · reported by VulnCheckMedium 6.3
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
- Product
- holaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88164 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Skydropx: Missing AuthorizationCVE-2026-108480 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
- Product
- Skydropx
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Skydropx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).CVE-2026-89072 · Other software · Progress · reported by security@progress.comHigh 7.5
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- Product
- MOVEit Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 14, 2026Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the rCVE-2026-76113 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
- Product
- Terraform Provider for Redfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy oCVE-2026-94197 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and method headers are forwarded unsanitized into the internal authentication subrequest (handled by the NGINX auth_request directive). As a result, an unauthenticated, remote attacker may spoof request attributes evaluated by the external authentication provider. Impact: This vulnerability may allow remote attackers unauthenticated access to protected paths. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Ingress Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs.CVE-2026-63792 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 5.3
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unCVE-2026-110630 · Other software · venturedrake · reported by VulnCheckHigh 7
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through LCVE-2026-110629 · Other software · venturedrake · reported by VulnCheckHigh 7.1
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by suCVE-2026-110624 · Other software · papermerge · reported by VulnCheckLow 2.3
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documCVE-2026-110623 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page managCVE-2026-110622 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary prCVE-2026-110621 · Other software · Swetrix · reported by VulnCheckHigh 8.7
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
- Product
- swetrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resoCVE-2026-110620 · Other software · formbricks · reported by VulnCheckMedium 6.1
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
- Product
- formbricks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers toCVE-2026-110617 · Other software · rachelos · reported by VulnCheckMedium 6.3
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
- Product
- we-mp-rss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to chaCVE-2026-110615 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app CVE-2026-110613 · Other software · youlaitech · reported by VulnCheckHigh 7.1
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
- Product
- youlai-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifyinCVE-2026-110611 · Other software · getrebuild · reported by VulnCheckMedium 6
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
- Product
- rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label oCVE-2025-71433 · Other software · usekaneo · reported by VulnCheckHigh 7.7
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
- Product
- kaneo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticatedCVE-2026-82026 · Other software · skyhook-io · reported by VulnCheckHigh 8.7
Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's own kubeconfig and process credentials injected into the shell environment, achieving remote code execution with Radar's privileges even when the --disable-local-terminal flag is set.
- Product
- radar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WP OAuth Server: Missing AuthorizationCVE-2026-107433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
- Product
- WP OAuth Server
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update WP OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-107426 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Bus Ticket Booking with Seat Reservation: Missing AuthorizationCVE-2026-107425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
- Product
- Bus Ticket Booking with Seat Reservation
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2026-107417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
- Product
- Push Notification for Post and BuddyPress
- Affected
- up to 3.23
- What to do
- Affects up to 3.23. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior tCVE-2026-85298 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 7.3
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.
- Product
- Application Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cloud.google.comdocs.cloud.google.com
Oct 14, 2026JetFormBuilder: Missing AuthorizationCVE-2026-107431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
- Product
- JetFormBuilder
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Restricted Site Access: Missing AuthorizationCVE-2026-110227 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
- Product
- Restricted Site Access
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Restricted Site Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026JNews - Jeg Elementor Kit: Unauthorized access of dataCVE-2026-103907 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
- Product
- JNews - Jeg Elementor Kit
- Affected
- up to 3.2.19
- What to do
- Affects up to 3.2.19. Update JNews - Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026AWP Classifieds: Does not verify that a request is authorised to view a listingCVE-2026-96904 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
- Product
- AWP Classifieds
- Fixed in
- 4.4.9
- What to do
- Update AWP Classifieds to 4.4.9 or newer.
Oct 14, 2026GamiPress: Does not properly authorize access to private activity log entriesCVE-2026-107320 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
- Product
- GamiPress
- Fixed in
- 8.0.6
- What to do
- Update GamiPress to 8.0.6 or newer.
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or input sanitization before storing certain values from a requestCVE-2026-107160 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
- Product
- LTL Freight Quotes
- Fixed in
- 4.2.19
- What to do
- Update LTL Freight Quotes to 4.2.19 or newer.
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or validation on one of its REST routes that writes to the databaseCVE-2026-107158 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
- Product
- LTL Freight Quotes
- Fixed in
- 4.2.19
- What to do
- Update LTL Freight Quotes to 4.2.19 or newer.
Oct 14, 2026NEX-Forms: Does not perform any authorizationCVE-2026-106166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
- Product
- NEX-Forms
- Fixed in
- 9.3.1
- What to do
- Update NEX-Forms to 9.3.1 or newer.
Oct 14, 2026WP Data Access: Does not restrict its database table export action to authorized usersCVE-2026-106099 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
- Product
- WP Data Access
- Fixed in
- 5.5.84
- What to do
- Update WP Data Access to 5.5.84 or newer.
Oct 14, 2026WP Data Access: Does not correctly check authorization on one of its application REST endpointsCVE-2026-106098 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
- Product
- WP Data Access
- Fixed in
- 5.5.77
- What to do
- Update WP Data Access to 5.5.77 or newer.
Oct 13, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Authorization bypassCVE-2026-17092 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Affected
- up to 8.10.2.1
- What to do
- Affects up to 8.10.2.1. Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Booking Package: Authorization bypassCVE-2026-103423 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier.
- Product
- Booking Package
- Affected
- up to 1.7.29
- What to do
- Affects up to 1.7.29. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 13, 2026Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.CVE-2026-15468 · Other software · HYPR · reported by security@hypr.comMedium 6.9
Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3.
- Product
- Passwordless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged soCVE-2026-110160 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.2
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 13, 2026Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local prCVE-2026-110159 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 13, 2026Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside theCVE-2026-110144 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.6
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 13, 2026Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-96956 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorizatCVE-2026-95695 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-95639 · Other software · Adobe · reported by AdobeHigh 8.6
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Photoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-94520 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.9
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-94512 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-88089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- Product
- Microsoft SQL Server 2017 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-88088 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.CVE-2026-88086 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
- Product
- Microsoft SQL Server 2019 (GDR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.