Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,146 results · page 2 of 43
Oct 14, 2026Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sizedCVE-2026-101341 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026CamPay Shortcode Payment Gateway: Does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parametersCVE-2026-105975 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
- Product
- CamPay Shortcode Payment Gateway
- Fixed in
- 1.7
- What to do
- Update CamPay Shortcode Payment Gateway to 1.7 or newer.
Oct 13, 2026TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.CVE-2026-110445 · Other software · TEAMPLUS TECHNOLOGY · reported by twcert@cert.org.twHigh 8.6
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
- Product
- TeamPlus Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 13, 2026TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.CVE-2026-110444 · Other software · TEAMPLUS TECHNOLOGY · reported by twcert@cert.org.twHigh 8.6
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
- Product
- TeamPlus Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 13, 2026The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value.CVE-2026-85473 · Other software · Auth0 · reported by psirt@okta.comMedium 5.3
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
- Product
- java-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrust.okta.com
Oct 13, 2026Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-83966 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-83965 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-100131 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-100130 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance 3D Sampler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.CVE-2026-97801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.CVE-2026-97782 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.8
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96960 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-96926 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.CVE-2026-96858 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-96855 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.CVE-2026-96316 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.CVE-2026-96315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.CVE-2026-96311 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.CVE-2026-96218 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.CVE-2026-88162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a netCVE-2026-88092 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.4
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
- Product
- ASP.NET Core 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.CVE-2026-87709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.CVE-2026-84009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.CVE-2026-83865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.CVE-2026-83715 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83697 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.CVE-2026-83681 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
- Product
- Microsoft PowerToys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83657 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.CVE-2026-83656 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.CVE-2026-70216 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-70085 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-70083 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-70071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over aCVE-2026-69973 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.CVE-2026-69968 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.CVE-2026-69905 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.CVE-2026-62879 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-103560 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondCVE-2026-95117 · Other software · reported by MITRE
Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 12, 2026MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weightsCVE-2026-109360 · Other software · Project-MONAI · reported by VulnCheckHigh 7.7
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
- Product
- MONAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVidCVE-2026-109251 · Other software · FreeRDP · reported by VulnCheckMedium 6
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering heCVE-2026-105274 · Other software · erlang · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.1
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). hex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it. hex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:safe_binary_to_term/1, which calls binary_to_term(Binary, [safe]). The safe option prevents atom creation, but it accepts compressed terms and doesn't limit the size of the decoded term, and the check that rejects functions and ports runs after the term has been built. The fix for CVE-2026-21619 added the safe option and that check without bounding
- Product
- rebar3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 12, 2026Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk spaCVE-2026-96618 · Other software · hexpm · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2.1
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks registry signatures and package checksums that the mirror can't forge. Several response paths consume memory or disk in proportion to what the mirror sends before any of those checks run. Hex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for compressed responses, so the server decides whether this step runs. It applies to registry, package, docs and API responses. Package tarballs have no download size limit. Hex 2.5.1 holds the whole tarball in memory and writes it to the cache, and the development branch streams it to a temporary file; the 16 MiB tarball limit is checked only when the file is unpacked. The ta
- Product
- hex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 12, 2026SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly comCVE-2026-109226 · Other software · sgl-project · reported by VulnCheckHigh 8.7
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachCVE-2026-109168 · Other software · dromara · reported by VulnCheckHigh 7.1
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.
- Product
- lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' filCVE-2026-109166 · Other software · dromara · reported by VulnCheckHigh 7.1
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.
- Product
- lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputsCVE-2026-108976 · Other software · GNU · reported by MITREHigh 7.8
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
- Product
- Emacs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.gnu.orgopenwall.com
Oct 9, 2026Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenCVE-2026-108096 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.1
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
- Product
- aws-amplify/graphql-index-transformer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Oct 7, 2026A flaw was found in the cluster-samples-operator.CVE-2026-107176 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.
- Product
- Red Hat OpenShift Container Platform 4.20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 7, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal seCVE-2026-76472 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-76472 are related to issues with improper neutralization of special elements that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.
- Product
- Cisco Campus Gateway Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.