Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,599 results · page 183 of 772
Mar 2, 2026An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.CVE-2026-24107 · Network & remote access · Tenda · reported by MITRECritical 9.8
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead to critical command injection vulnerabilities.
- Product
- W20e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenda.com.cn
Mar 2, 2026A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS).CVE-2026-23600 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS).
- Product
- HPE AutoPass License Server (APLS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50187 · Other software · chamilo · reported by GitHubCritical 9.8
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credeCVE-2026-3432 · Other software · SimStudioAI · reported by vulnreport@tenable.comCritical 9.3
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
- Product
- sim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictiCVE-2026-3431 · Other software · SimStudioAI · reported by vulnreport@tenable.comCritical 9.8
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
- Product
- sim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result iCVE-2025-14532 · Other software · Studio Fabryka · reported by cvd@cert.plCritical 9.3
DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
- Product
- DobryCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026A Blind SQL injection vulnerability has been identified in DobryCMS.CVE-2025-12462 · Other software · Studio Fabryka · reported by cvd@cert.plCritical 9.3
A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.
- Product
- DobryCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl",CVE-2025-30044 · Other software · CGM · reported by cvd@cert.plCritical 9.4
In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certifiCVE-2025-30042 · Other software · CGM · reported by cvd@cert.plCritical 9
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, CVE-2025-30035 · Other software · CGM · reported by cvd@cert.plCritical 9
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system.CVE-2026-2584 · Other software · Ciser System SL · reported by cve-coordination@incibe.esCritical 9.3
A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) can exploit this flaw by sending specially crafted SQL queries through the login interface. Due to low attack complexity (AC:L) and the absence of specific requirements (AT:N), the vulnerability allows for a total compromise of the system's configuration data (VC:H/VI:H). While the availability of the service remains unaffected (VA:N), the breach may lead to a limited exposure of sensitive information regarding subsequent or interconnected systems (SC:L).
- Product
- CSIP firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on thCVE-2026-3422 · Other software · e-Excellence · reported by twcert@cert.org.twCritical 9.3
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 2, 2026IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to dCVE-2026-3000 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
- Product
- IDExpert Windows Logon Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchangingtec.comtwcert.org.tw
Mar 2, 2026IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to dCVE-2026-2999 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
- Product
- IDExpert Windows Logon Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchangingtec.comtwcert.org.tw
Feb 28, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for InformCVE-2026-3010 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Critical 9.3
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.
- Product
- TimePictra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2026Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: CVE-2026-2844 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Critical 9.3
Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.
- Product
- TimePictra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php.CVE-2026-28517 · Other software · openDCIM · reported by VulnCheckCritical 9.3
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
- Product
- openDCIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Feb 27, 2026openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter.CVE-2026-28516 · Other software · openDCIM · reported by VulnCheckCritical 9.3
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
- Product
- openDCIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Feb 27, 2026openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php.CVE-2026-28515 · Other software · openDCIM · reported by VulnCheckCritical 9.3
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
- Product
- openDCIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28411 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28409 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28408 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's URL on the web to access features exclusive to employees. The vulnerability allows external parties to inject unauthorized data in massive quantities into the application server's storage. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-28268 · Other software · go-vikunja · reported by GitHubCritical 9.8
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Group-Office is an enterprise customer relationship management and groupware tool.CVE-2026-27947 · Other software · Intermesh · reported by GitHubCritical 9.4
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticatCVE-2026-27755 · Other software · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) · reported by VulnCheckCritical 9.3
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifier offline and bypass authentication without completing the login flow, gaining unauthorized access to the device.
- Product
- SODOLA SL902-SWTGW124AS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsodola-network.comvulncheck.com
Feb 27, 2026SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative accCVE-2026-27751 · Other software · Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) · reported by VulnCheckCritical 9.3
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default credentials without password change enforcement to gain full administrative control of the device.
- Product
- SODOLA SL902-SWTGW124AS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsodola-network.comvulncheck.com
Feb 27, 2026Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects CentreonCVE-2026-2750 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.1
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
- Product
- Centreon Open Tickets on Central Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central SeCVE-2026-2749 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Critical 9.9
Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.
- Product
- Open Tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Pro3W CMS if vulnerable to SQL injection attacks.CVE-2025-15498 · Other software · Pro3W · reported by cvd@cert.plCritical 9.3
Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0 of this software. Due to lack of response from the vendor exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later.
- Product
- Pro3W CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc.CVE-2025-11252 · Other software · Signum Technology Promotion and Training Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection. This issue affects windesk.Fm: before v2.3.4. NOTE: The vendor patched the vulnerability after the CVE was published.
- Product
- windesk.fm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 27, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc.CVE-2025-11251 · Websites & servers · Dayneks Software Industry and Trade Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection. This issue affects E-Commerce Platform: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Commerce Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 27, 2026Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to CVE-2026-2251 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fCritical 9.8
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads https://www.support.xerox.com/en-us/product/core/downloads
- Product
- FreeFlow Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Feb 27, 2026Listee: Privilege escalationCVE-2025-12981 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the user_role parameter. This makes it possible for unauthenticated attackers to register as Administrator by manipulating the user_role parameter during registration.
- Product
- Listee
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Listee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlistee-wp.dreamstechnologies.comthemeforest.net
Feb 27, 2026In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the VCVE-2026-28370 · Other software · OpenStack · reported by MITRECritical 9.1
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. This occurs in _create_query_function in vitrage/graph/query.py.
- Product
- Vitrage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstoryboard.openstack.org
Feb 26, 2026In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlistCVE-2026-28363 · Other software · OpenClaw · reported by MITRECritical 9.9
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27028 · Other software · Mobility46 · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- mobility46.se
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on thCVE-2026-24663 · Other software · Copeland · reported by ics-cert@hq.dhs.govCritical 9
An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote code execution on the system by sending a crafted request to the libraries installation route and injecting malicious input into the request body.
- Product
- Copeland XWEB 300D PRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebapps.copeland.com
Feb 26, 2026An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement aCVE-2026-21718 · Other software · Copeland · reported by ics-cert@hq.dhs.govCritical 10
An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentication requirement and achieve pre-authenticated code execution on the system.
- Product
- Copeland XWEB 300D PRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebapps.copeland.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27772 · Other software · EV Energy · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- ev.energy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-27767 · Other software · SWITCH EV · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- swtchenergy.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comswtchenergy.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-25851 · Other software · Chargemap · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- chargemap.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchargemap.comgithub.com
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-24731 · Other software · EV2GO · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- ev2go.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the baCVE-2026-20781 · Other software · CloudCharge · reported by ics-cert@hq.dhs.govCritical 9.3
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
- Product
- cloudcharge.se
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudcharge.techgithub.com
Feb 26, 2026hoppscotch is an open source API development ecosystem.CVE-2026-28215 · Other software · hoppscotch · reported by GitHubCritical 9.1
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs no check on whether onboarding was already completed. A successful exploit allows the attacker to replace the instance's Google/GitHub/Microsoft OAuth application credentials with their own, causing all subsequent user logins via SSO to authenticate against the attacker's OAuth app. The attacker captures OAuth tokens and email addresses of every user who logs in after the exploit. Additionally, the endpoint returns a recovery token that can be used to read all stored secrets in plaintext, including SMTP passwords and any other configured credentials. Version 2026.2.0 fixes the issue.
- Product
- hoppscotch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026EverShop is a TypeScript-first eCommerce platform.CVE-2026-28213 · Other software · evershopcommerce · reported by GitHubCritical 9.8
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
- Product
- evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT prCVE-2026-22207 · Other software · Volcengine · reported by VulnCheckCritical 9.3
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.
- Product
- OpenViking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php.CVE-2025-50857 · Other software · reported by MITRECritical 9.8
ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 25, 2026Vitess is a database clustering system for horizontal scaling of MySQL.CVE-2026-27969 · Other software · vitessio · reported by GitHubCritical 9.3
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.
- Product
- vitess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Langflow is a tool for building and deploying AI-powered agents and workflows.CVE-2026-27966 · Other software · langflow-ai · reported by GitHubCritical 9.8
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE). Version 1.8.0 fixes the issue.
- Product
- langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenLIT is an open source platform for AI engineering.CVE-2026-27941 · Other software · openlit · reported by GitHubCritical 9.9
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.
- Product
- openlit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.