Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
851 results · page 2 of 18
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: disconnect on CSA to channel 0 The refactor for the CSA parsing erroneouslCVE-2026-90344 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: disconnect on CSA to channel 0 The refactor for the CSA parsing erroneously equates channel zero and no information present, leading it to ignore a CSA on an AP that advertises a switch to that (invalid) channel. This leads to not disconnecting, which we should. For Intel devices, this can lead to a firmware crash. Fix this by using an int type for the channel number as well as the opclass, and using a (negative) value that cannot be encoded in the element to indicate it's not present.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found wCVE-2026-90331 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asus_raw_event() - unclean teardown of asus_probe on failure - possible use-after-free in asus_probe - multiple workqueue used for jobs where one was enough - sleeping calls in atomic context - packets of incorrect size being sent to the keyboard controller Join the two workqueues into one reusing the stopping mechanism of the brightness workqueue, use the joined workqueue to also move the asus_wmi_send_event() sleeping call away from atomic context and add a size check in asus_raw_event().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equalityCVE-2026-92914 · Other software · WWBN · reported by VulnCheckHigh 8.6
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offsCVE-2026-89906 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[insn + 1] - ctx->idx". To avoid a false 16-bit range check abort during size estimation, add a "ctx->image == NULL" guard to inject a safe dummy offset.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 15, 2026atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers toCVE-2026-91988 · Other software · dep0we · reported by VulnCheckCritical 9.2
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
- Product
- atomic-agents-stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 15, 2026An issue was discovered in Keyfactor SignServer before 7.6.0.CVE-2026-25827 · Other software · reported by MITRELow 2.3
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties were identified: The property ATTRIBUTESFILE in PKCS11CryotoToken can be set to a readable but not an accepted (i.e., recognized with attributes) file. In this case an error is thrown, confirming the existence of the file. The property KEYSTOREPATH in KeyStoreCryptoToken can be set to a non-existing file that will return an error confirming to the client side that the file does not exist. The property TRUSTSTOREPATH in RenewalWorker can be set to any path (without any restrictions) by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized PEM format, it returns this as an error to the client side, confirming the existences of the file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyfactor.comsupport.keyfactor.com
Sep 15, 2026An issue was discovered in Keyfactor SignServer before 7.6.0.CVE-2026-25826 · Other software · reported by MITREMedium 4.9
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyfactor.comsupport.keyfactor.com
Sep 15, 2026An issue was discovered in Keyfactor SignServer before 7.6.0.CVE-2026-25825 · Other software · reported by MITRELow 2.7
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyfactor.comsupport.keyfactor.com
Sep 14, 2026Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable eCVE-2026-91197 · Other software · flowable · reported by VulnCheckHigh 7.1
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
- Product
- flowable-engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026Really Simple Security: Does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolmentCVE-2026-89080 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
- Product
- Really Simple Security
- Fixed in
- 9.8.1
- What to do
- Update Really Simple Security to 9.8.1 or newer.
Sep 11, 2026The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.UCVE-2026-82617 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 10
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion by a small crafted input. For the EMAIL pattern, a long run of local-part characters that is never followed by an @ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows quadratically with input length: an input of approximately 32 KB consumes several seconds of CPU in a single find() call and returns no match, and each doubling of the input multiplies the cost roughly four-fold. For the URL pattern, the query-string sub-expression nests a capturing repetition inside an outer repetition. The JDK matcher recurses once per query token, so an input of approximately 4 KB containing many &-separated tokens exhausts the thread stack and causes java.lang.Sta
- Product
- Apache OpenNLP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 11, 2026The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-sCVE-2026-78224 · Other software · NextGen Healthcare · reported by ics-cert@hq.dhs.govHigh 8.8
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.
- Product
- Mirth Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.CVE-2025-15679 · Other software · Bull · reported by 5bcc34ac-0282-4e8a-96fc-046c583d3048High 7.3
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
- Product
- BullSequana XH3406
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokenCVE-2026-88895 · Other software · usmannasir · reported by VulnCheckHigh 8.6
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
- Product
- cyberpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 10, 2026Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within tCVE-2026-85544 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 6.1
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
- Product
- DS-KV9503
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not scope its second-factor attempt limit to the account being attackedCVE-2026-77771 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 8, 2026Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81376 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete CVE-2026-73313 · Other software · XenForo · reported by VulnCheckHigh 7.6
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.
- Product
- XenForo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbombobombone.github.iogithub.com
Sep 4, 2026LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackeCVE-2026-85673 · Other software · hiyouga · reported by VulnCheckHigh 8.7
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
- Product
- LlamaFactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality.CVE-2026-85590 · Other software · thorsten · reported by VulnCheckHigh 7.1
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactor_enabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 3, 2026SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed.CVE-2026-84831 · Other software · SEPPmail AG · reported by vulnerability@ncsc.chHigh 7.7
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor.
- Product
- SEPPmail Secure Email Gateway (SEG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.seppmail.com
Sep 1, 2026A privilege escalation security issue exists within FactoryTalk® Activation Manager.CVE-2026-16675 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.
- Product
- FactoryTalk® Activation Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 1, 2026A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition.CVE-2026-12661 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comMedium 4.8
A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive.
- Product
- FactoryTalk® Historian Machine Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 1, 2026A security issue exists within FactoryTalk® Historian Machine Edition.CVE-2025-12768 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.6
A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.
- Product
- FactoryTalk® Historian Machine Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Aug 29, 2026Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_toCVE-2026-82467 · Other software · jeremyevans · reported by VulnCheckMedium 4.9
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
- Product
- rodauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-82329 · Other software · JFrog · reported by reefs@jfrog.comExploitedCritical 9.8
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
- Product
- Artifactory
- On CISA’s list since
- Sep 2, 2026 (federal fix deadline Sep 5, 2026)
- What to do
- Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocs.jfrog.comdocs.jfrog.com
Aug 27, 2026DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigCVE-2026-59317 · Other software · Spring · reported by security@vmware.comMedium 6.5
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
- Product
- Spring for Apache Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.CVE-2026-47879 · Other software · Spring · reported by security@vmware.comHigh 7.7
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
- Product
- Spring Cloud Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replaCVE-2026-41707 · Other software · Spring · reported by security@vmware.comHigh 7.4
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. This issue affects Spring Security: 7.1.0, from 7.0.0 through 7.0.6, and from 6.5.0 through 6.5.11.
- Product
- Spring Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge CVE-2026-78655 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record in the session, raising it on each rejected code and deleting the pending record once it reaches attempts, five by default. Punk::Session carries the session in a signed cookie unless the application declares a store, and keeps no server-side record, so an earlier value of the same session stays valid until the expiry stamped inside it. A client that saves the cookie before its failed attempts and presents it again gets the pending record back with its counter, and the limit never fires. The replayed record is accepted while its own expiry, pending_ttl seconds from the challenge and 300 by default, has not passed. Sessions declared with a store are not affected: the pending record and its counter then live server-side. The attempt limit does not bound guessing of the second factor, which is left to the per-address rate limit the plugin registers on the same path, 30 requests per 60 secon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user idenCVE-2026-78619 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadataCVE-2026-70550 · Other software · jfrog · reported by reefs@jfrog.comMedium 6.5
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 25, 2026Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.CVE-2026-70548 · Other software · jfrog · reported by reefs@jfrog.comLow 3.5
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 25, 2026A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.CVE-2026-70551 · Other software · jfrog · reported by reefs@jfrog.comHigh 8.5
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 25, 2026An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorCVE-2026-69104 · Other software · jfrog · reported by reefs@jfrog.comHigh 7.6
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 21, 2026Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable floCVE-2026-59799 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-66800 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each sCVE-2026-76213 · Other software · thorsten · reported by VulnCheckCritical 9.1
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 19, 2026phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes.CVE-2026-76207 · Other software · thorsten · reported by VulnCheckHigh 8.6
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring inCVE-2026-72103 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 ("md: port block device access to file") accidentally causes the caller's thread keyring to be kept alive long beyond the caller's lifetime. As a result, "cryptsetup luksSuspend" silently fails to wipe the LUKS volume key from memory. In detail: "cryptsetup luksOpen" uses its supposedly ephemeral thread keyring to pass the volume key to the kernel. dm-crypt's crypt_set_keyring_key() copies the key material into its own crypt_config structure and then drops its own reference to the key in the keyring with key_put(). With this fix, restoring pre-v6.9 behavior, the copy in the thread keyring is then promptly garbage collected, such that exactly one copy of the volume key remains. This single copy is correctly wiped from memory on "cryptsetup luksSuspend". Without this fix, the thread keyring and the volume key in it remains. This second copy is only freed on "luksClose". "luksSuspend" neither knows about this copy nor has any way to remove it, so the key remains recoverable from RAM after a suspend that
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 13, 2026The Link Factory WordPress plugin is a backdoor.CVE-2026-15413 · WordPress plugins & themes · reported by WPScanCritical 10
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
- What to do
- Update the plugin to the newest version.
Aug 12, 2026A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.CVE-2026-69106 · Other software · jfrog · reported by reefs@jfrog.comHigh 8.8
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026JFrog Artifactory Improper Authentication VulnerabilityCVE-2026-42018 · Other software · JFrog · reported by reefs@jfrog.comExploitedHigh 7.5
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- Product
- Artifactory
- On CISA’s list since
- Sep 11, 2026 (federal fix deadline Sep 25, 2026)
- What to do
- Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocs.jfrog.comdocs.jfrog.com
Aug 12, 2026An authenticated user without repository read permission may access package metadata under specific conditions.CVE-2026-70547 · Other software · jfrog · reported by reefs@jfrog.comMedium 4.3
An authenticated user without repository read permission may access package metadata under specific conditions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.CVE-2026-69107 · Other software · jfrog · reported by reefs@jfrog.comMedium 5.9
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabilitCVE-2026-69105 · Other software · jfrog · reported by reefs@jfrog.comHigh 8.1
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026A holder of a valid integration credential may impersonate other users under specific conditions.CVE-2026-68759 · Other software · jfrog · reported by reefs@jfrog.comHigh 7.2
A holder of a valid integration credential may impersonate other users under specific conditions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026A low-privileged authenticated user may access restricted support information under specific conditions.CVE-2026-68758 · Other software · jfrog · reported by reefs@jfrog.comMedium 6.5
A low-privileged authenticated user may access restricted support information under specific conditions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityCVE-2026-66384 · Other software · JFrog · reported by reefs@jfrog.comExploitedMedium 5.3
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
- Product
- Artifactory
- On CISA’s list since
- Aug 27, 2026 (federal fix deadline Sep 10, 2026)
- What to do
- Attackers are using this now. Install JFrog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocs.jfrog.comdocs.jfrog.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.