Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

13,107 results · page 2 of 263

Oct 24, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.
Product
Events Manager
Affected
up to 7.4.8
What to do
Affects up to 7.4.8. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026Pixel Tag Manager for WooCommerce: Does not perform a capability check in one of its AJAX actionsCVE-2026-105199 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Product
Pixel Tag Manager for WooCommerce
Fixed in
2.2.3
What to do
Update Pixel Tag Manager for WooCommerce to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server toCVE-2026-95620 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Low 2.1
A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
Product
qt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codereview.qt-project.org wiki.qt.io
Oct 23, 2026Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to bCVE-2026-25716 · Other software · Hallo Welt! GmbH · reported by security@bluespice.comHigh 7.1
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
Product
BlueSpice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.wiki.bluespice.com
Oct 23, 2026Car Rental Manager: Missing AuthorizationCVE-2026-112825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.
Product
Car Rental Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference.CVE-2026-4952 · Other software · VertiGIS Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.1
The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Product
WebOrderSystem (AuftragsManager)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com
Oct 23, 2026The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user CVE-2026-4951 · Other software · VertiGIS Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.1
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows the URL structure can craft a link that contains script code. The code runs if a privileged user who is currently logged into the portal opens the link. Because administrative users can change the passwords of other users, including administrators, without entering the old password, an attacker may be able to take over accounts or lock out other users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Product
WebOrderSystem (KundenManager)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com
Oct 23, 2026The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups).CVE-2026-4950 · Other software · VertiGIS Ltd. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.8
The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.
Product
WebOrderSystem (KundenManager)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com
Oct 21, 2026In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary oCVE-2026-76293 · Other software · Splunk · reported by psirt@cisco.comHigh 7.2
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com
Oct 21, 2026Apache Pulsar Manager is a web console for administering Apache Pulsar clusters.CVE-2026-105944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 10
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues: - The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later. - Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager. - The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Puls
Product
Apache Pulsar Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org pulsar.apache.org
Oct 21, 2026A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could CVE-2026-76487 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Product
Cisco Unified Communications Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026A flaw was found in the PathResourceManager component of the Undertow web server.CVE-2026-114370 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
Product
Red Hat build of Apache Camel for Spring Boot 4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 21, 2026A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of SeCVE-2025-60479 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authenticaCVE-2024-7478 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.8
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
Product
WSO2 API Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Oct 21, 2026The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not inCVE-2024-6423 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Product
WSO2 API Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Oct 21, 2026The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.CVE-2024-4989 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.4
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
Product
WSO2 API Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security.docs.wso2.com
Oct 21, 2026Download Manager WordPress plugin before 3.3.71, Download Manager: Does not have CSRF checks in some placesCVE-2026-86611 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Product
Download Manager WordPress plugin before 3.3.71, Download Manager
Fixed in
3.3.71
What to do
Update Download Manager WordPress plugin before 3.3.71, Download Manager to 3.3.71 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Advanced File Manager: Does not correctly determine whether a stored file is an SVG before sanitising itCVE-2026-79627 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
Product
Advanced File Manager
Fixed in
6.0.0
What to do
Update Advanced File Manager to 6.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026WP User Manager: Does not keep its paid-registration capability restrictions in force once the payment gateway is disconnectedCVE-2026-110523 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
Product
WP User Manager
Fixed in
2.9.26
What to do
Update WP User Manager to 2.9.26 or newer.
Full record and what to do →NVD record wpscan.com
Oct 20, 2026Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).CVE-2026-91532 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
Oracle Applications Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer).CVE-2026-91501 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Oracle Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).CVE-2026-91494 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).CVE-2026-91493 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).CVE-2026-91492 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.7
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).CVE-2026-91491 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).CVE-2026-91490 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).CVE-2026-91489 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).CVE-2026-91488 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).CVE-2026-91408 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Product
Oracle Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).CVE-2026-91407 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
Oracle Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91372 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91371 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.8
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91370 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91369 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91368 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.1
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91367 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91366 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data as well as unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91365 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91364 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.8
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91363 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.7
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91362 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91361 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91360 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).CVE-2026-91359 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel CRM Cloud Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).CVE-2026-91316 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Product
iProcurement
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).CVE-2026-91260 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement. Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Product
iProcurement
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).CVE-2026-91259 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Product
Oracle Identity Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).CVE-2026-91212 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.6
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).CVE-2026-91211 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.7
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
Product
Oracle Identity Manager Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).CVE-2026-87337 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 10
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Product
Oracle Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.