Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,908 results · page 19 of 199
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61778 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61777 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61776 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61775 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61774 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61773 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61772 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61771 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61770 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61769 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61768 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61767 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61766 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61765 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61764 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61763 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61762 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61761 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61760 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61759 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61758 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61757 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61756 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61755 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61754 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61753 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61752 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61751 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data.CVE-2026-61750 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Megatron Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Sep 1, 2026Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via senCVE-2026-51741 · Other software · reported by MITRECritical 9.8
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36.CVE-2026-82346 · Other software · HP Inc · reported by hp-security-alert@hp.comHigh 7
A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.
- Product
- HP ImageDiags
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state viaCVE-2026-51713 · Other software · reported by MITRECritical 9.1
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-IdentCVE-2026-59111 · Other software · Ministry of the Interior (MVČR) · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.3
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
- Product
- eObčanka-Identifikace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated dCVE-2026-82653 · Other software · siyuan-note · reported by VulnCheckCritical 9.3
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 28, 2026Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic CVE-2026-51665 · Other software · reported by MITREMedium 4.3
Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuratioCVE-2026-51649 · Other software · reported by MITRECritical 9.1
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reCVE-2026-51610 · Other software · reported by MITREMedium 4.3
Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235_probe() handles its error paths incCVE-2026-80650 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235_probe() handles its error paths incorrectly. If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free. If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked. gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe(). Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 27, 2026WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log.CVE-2026-78174 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Critical 9.3
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.
- Product
- Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to wriCVE-2026-81838 · Other software · aws · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.8
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
- Product
- diagram-as-code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Aug 27, 2026ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform.CVE-2026-74820 · Other software · ServiceNow · reported by psirt@servicenow.comCritical 10
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- Product
- ServiceNow AI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Aug 27, 2026ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform.CVE-2026-6876 · Other software · ServiceNow · reported by psirt@servicenow.comCritical 10
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- Product
- ServiceNow AI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Aug 27, 2026ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform.CVE-2026-18886 · Other software · ServiceNow · reported by psirt@servicenow.comCritical 10
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- Product
- ServiceNow AI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Aug 27, 2026ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform.CVE-2026-18885 · Other software · ServiceNow · reported by psirt@servicenow.comCritical 10
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- Product
- ServiceNow AI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.servicenow.com
Aug 27, 2026GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.CVE-2026-75871 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.2
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.
- Product
- GitLab AI Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Aug 27, 2026GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19CVE-2026-19889 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.2
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials.
- Product
- GitLab AI Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.CVE-2026-78281 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2026The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.CVE-2026-75330 · Other software · reported by MITRECritical 9.8
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.CVE-2026-75329 · Other software · reported by MITRECritical 9.8
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administratiCVE-2026-65930 · Other software · LimeSurvey · reported by help@fluidattacks.comMedium 4.8
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.