Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

8,653 results · page 2 of 174

Oct 26, 2026NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that truCVE-2026-116487 · Other software · NXP · reported by VulnCheckMedium 5.1
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.
Product
mcuxsdk-middleware-usb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 26, 2026Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote aCVE-2026-109584 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
Product
bandit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.erlef.org github.com
Oct 26, 2026Advanced Post Block - Post Grid for WordPress block editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115955 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.
Product
Advanced Post Block - Post Grid for WordPress block editor
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Advanced Post Block - Post Grid for WordPress block editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2026Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 comCVE-2026-95664 · Email & office · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3Utils.determineKey() also passed the resulting value to the Simple language whenever it contained ${ or $simple{, so that a route could use a dynamic key, and the evaluation applied to a value taken from the header as well as to the configured option. The header is not route configuration, however: the aws2-s3 consumer sets CamelAwsS3Key on the exchanges it creates to the key of the object it read, that is, the name of the object in the bucket. In a route that does nothing more than consume from one aws2-s3 endpoint and produce to another, the name of each consumed object therefore reached the producer, and a name containing either marker was evaluated as an expression, although the route au
Product
Apache Camel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record camel.apache.org camel.apache.org
Oct 25, 2026A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress.CVE-2026-116107 · WordPress plugins & themes · reported by VulDBLow 2.1
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vuldb.com vuldb.com
Oct 25, 2026vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s CVE-2026-116175 · Other software · vllm-project · reported by VulnCheckHigh 7.1
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration limit. Authenticated attackers can send small compressed audio via input_audio or audio_url in /v1/chat/completions requests that expands to huge decoded PCM, exhausting server memory.
Product
vllm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 25, 2026ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images.CVE-2026-116149 · Other software · ImageMagick · reported by VulnCheckHigh 7.2
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.
Product
ImageMagick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 25, 2026Duplicator: Does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5CVE-2026-115251 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
Product
Duplicator
Fixed in
5.0.0
What to do
Update Duplicator to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2026InstaWP Connect: Does not perform a capability check on its InstaWP Connect WordPress plugin before 0CVE-2026-114743 · WordPress plugins & themes · reported by WPScanLow 3.1
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
Product
InstaWP Connect
Fixed in
0.1.4.2
What to do
Update InstaWP Connect to 0.1.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.CVE-2026-115897 · Other software · yahoo · reported by GitHubLow 2.1
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.
Product
serialize-javascript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.CVE-2026-113877 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com metacpan.org
Oct 23, 2026The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites.CVE-2026-55826 · WordPress plugins & themes · reported by GitHubHigh 8.7
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVECVE-2026-115728 · Other software · hapijs · reported by VulnCheckHigh 8.7
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Product
@hapi/content
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode prCVE-2026-94263 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated useCVE-2026-111965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112837 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
Product
GamiPress
Affected
up to 8.0.7
What to do
Affects up to 8.0.7. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content.CVE-2025-30045 · Other software · CGM · reported by cvd@cert.plHigh 8.6
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cgm.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not resolve the target of the update-user action in its front-end Forms module consistently between the stage tCVE-2026-94268 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not perform any capability checkCVE-2026-94267 · WordPress plugins & themes · reported by WPScanCritical 9
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not validate or escape some of its form shortcode attributesCVE-2026-94264 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Music Store – WordPress eCommerce: Directory TraversalCVE-2026-115497 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
Product
Music Store – WordPress eCommerce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Music Store – WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2026OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.CVE-2026-115638 · Other software · OpenStack · reported by MITREMedium 4.3
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
Product
Ironic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net openwall.com
Oct 22, 2026Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients tCVE-2026-115508 · Other software · unclecode · reported by VulnCheckHigh 7.1
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
Product
crawl4ai
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to CVE-2026-115503 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
Product
ghidra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed CVE-2026-115396 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.
Product
ghidra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap orCVE-2026-113873 · Other software · SmileCDR · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Product
HAPI FHIR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abhinavagarwal07.github.io raw.githubusercontent.com
Oct 22, 2026body-parser is body parsing middleware for Node.js and Express.CVE-2026-111181 · Other software · body-parser · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 7.5
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.
Product
body-parser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.openjsf.org github.com
Oct 22, 2026Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrarCVE-2018-25438 · Other software · Intermesh · reported by VulnCheckHigh 8.7
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
Product
Group-Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com github.com
Oct 22, 2026Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory aCVE-2026-93471 · Other software · handnot2 · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.
Product
esaml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cna.erlef.org github.com
Oct 22, 2026Page Restriction WordPress (WP): Missing AuthorizationCVE-2026-114696 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.
Product
Page Restriction WordPress (WP)
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Page Restriction WordPress (WP) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Falcon – WordPress Optimizations & Tweaks: Missing AuthorizationCVE-2026-112826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.
Product
Falcon – WordPress Optimizations & Tweaks
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update Falcon – WordPress Optimizations & Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026WebP Express: Does not escape values that its bundled HTML parser re-emits into element attributesCVE-2026-97328 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Product
WebP Express
Fixed in
0.25.16
What to do
Update WebP Express to 0.25.16 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user dispCVE-2026-114570 · WordPress plugins & themes · reported by WordfenceMedium 4.9
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Affected
up to 7.0.2
What to do
Affects up to 7.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org wordpress.org
Oct 22, 2026PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro: Do not sanitise and escape a cookie value before printing it into the page outputCVE-2026-109987 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Product
PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro
Fixed in
11.4.3
What to do
Update PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro to 11.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76497 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.6
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76497 are related to issues concerning insecure temporary files that are grouped under the Common Weakness Enumeration (CWE) Base CWE-377.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76496 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76495 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76494 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76493 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76492 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76491 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehenCVE-2026-76490 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco ExpresCVE-2026-76466 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.CVE-2026-76435 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.3
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Product
Cisco TelePresence Video Communication Server (VCS) Expressway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attackCVE-2026-20218 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.   This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.
Product
Cisco Open Source Snort3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com
Oct 21, 2026Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex paCVE-2026-114401 · Other software · polonel · reported by VulnCheckMedium 6.9
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Product
trudesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publCVE-2026-114120 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Fixed in
5.3.5
What to do
Update the plugin to 5.3.5 or newer.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remCVE-2026-78048 · Websites & servers · Apache Software Foundation · reported by security@apache.org
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. Root Cause: In src/brpc/details/hpack.cpp, IndexTable::Init sizes the dynamic-table ring buffer as num_headers = max_size / (32 + 2), i.e. it assumes a minimum table entry of 34 bytes (name >= 1 byte + value >= 1 byte + 32 bytes of overhead). However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty (name >= 1 byte + value == 0 + 32 bytes). For the default 4096-byte table this allocates only 120 slots (4096/34). Eviction in AddHeader is driven by byte usage (_max_size), not by slot count, so a peer can add 121 minimal 33-byte entries (121*33 = 3993 <= 4096) without triggering eviction. The 121st AddHeader then hits CHECK(!_header_queue.full()), which aborts the process. Affected Scenarios: Use a bRPC server that serves HTTP/2 or gRPC requests (e.g. via the h2 protocol) from an untrusted network. The malicious header block is processed during HPACK d
Product
Apache bRPC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026WordPress Team Members – GS: Deserialization of Untrusted DataCVE-2026-110369 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
Product
WordPress Team Members – GS
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update WordPress Team Members – GS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.