Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

394,273 results · page 206 of 7886

Oct 19, 2026A vulnerability in Apache Answer.CVE-2026-67249 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Product
Apache Answer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026A vulnerability in Apache Answer.CVE-2026-64945 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Product
Apache Answer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.CVE-2026-64944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Product
Apache Answer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Insertion of Sensitive Information into Log File vulnerability in Apache Answer.CVE-2026-64943 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Product
Apache Answer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026MISP contains a vulnerability in the handling of module plugin settings.CVE-2026-112192 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings. - A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction. An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access. Affected: <2.5.48
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should havCVE-2026-112188 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree. Because a branch node does not carry a redaction flag, the redaction check in the settings retrieval endpoint is bypassed, and the full branch contents are returned to the caller. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys. A second endpoint that edits server settings similarly reads the entire configuration store when a branch name is resolved, returning all settings to the caller. The impact is disclosure of sensitive server configuration secrets to any user who can access the server settings endpoints. Affected versions: <2.5.48.
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface.CVE-2026-112184 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 4.8
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the misp-modules service can inject arbitrary HTML or JavaScript that executes in the context of an authenticated MISP user's browser. Preconditions: - The attacker must be able to control or influence parameter names reported by the misp-modules service. - A victim must be authenticated and view the affected workflow module page. Impact: - Execution of arbitrary JavaScript in the victim's browser session. - Potential theft of session tokens, manipulation of the MISP interface, or initiation of unauthorized actions on behalf of the victim. Affected versions: <2.5.48.
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026MISP contains a CSS injection vulnerability in the remote event preview feature.CVE-2026-112183 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 4.8
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the value is interpreted as CSS within the style attribute, allowing a malicious or compromised linked server to inject arbitrary CSS declarations. An attacker with the ability to create or modify tags on a linked MISP instance can craft a tag colour value containing CSS injection payloads. When a user on the local instance views the event preview, the injected CSS is rendered, potentially allowing UI manipulation, visual spoofing, or limited information disclosure through CSS-based techniques. Preconditions: - A linked MISP server relationship exists between the victim instance and the attacker-controlled instance. - The attacker can create or modify tags on the linked server. - A victim user views the remote event preview page. Affected: <2.5.48.
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026A vulnerability was detected in AXA Group NLP.js 4.27.0.CVE-2026-112102 · Other software · AXA Group · reported by VulDBLow 2.1
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
NLP.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0.CVE-2026-112101 · Other software · BlackBeltTechnology · reported by VulDBLow 2.1
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
Product
pi-agent-dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A vulnerability was determined in DeepPavlov up to 1.7.0.CVE-2026-112100 · Other software · reported by VulDBLow 2
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-111408 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Product
Quiz And Survey Master
Affected
up to 11.2.7
What to do
Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111407 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
Product
Tutor LMS
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2026-111406 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
Product
MapSVG
Affected
up to 8.16.1
What to do
Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026MapSVG: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-111398 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.
Product
MapSVG
Affected
up to 8.16.1
What to do
Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026Essential Addons for Elementor: Incorrect Privilege AssignmentCVE-2026-110898 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.
Product
Essential Addons for Elementor
Affected
up to 6.8.5
What to do
Affects up to 6.8.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026HivePress: Improper Control of Generation of Code ('Code Injection')CVE-2026-110887 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Product
HivePress
Affected
up to 1.7.32
What to do
Affects up to 1.7.32. Update HivePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026Quiz Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
Product
Quiz Maker
Affected
up to 6.7.1.91
What to do
Affects up to 6.7.1.91. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2026Allocation of resources without limits or throttling vulnerability in Apache Kylin.CVE-2026-108837 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Default startup profile miss security settings in Apache Kylin.CVE-2026-108833 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin.CVE-2026-108823 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Potential JDBC source configuration validation vulnerability in Apache Kylin.CVE-2026-108780 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin.CVE-2026-108776 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin.CVE-2026-108771 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Missing authorization on jdbc source config update in Apache Kylin.CVE-2026-108766 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Server-Side request forgery (SSRF) vulnerability in Apache Kylin.CVE-2026-108764 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026Path-confinement bypass during metadata backup deletion in Apache Kylin.CVE-2026-108762 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 19, 2026SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the CVE-2026-13695 · Other software · Integratec · reported by cve-coordination@incibe.esHigh 8.8
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
Product
Integratec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Oct 19, 2026MISP contains a data integrity flaw in its event deletion logic.CVE-2026-112180 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.1
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks, and attachment scan results. These orphaned records may contain sensitive threat intelligence data such as correlation mappings, scan results, and report metadata that should have been removed along with the parent event. Their persistence beyond the intended deletion lifecycle creates a risk of unintended data retention and potential information exposure if the records are reachable through other application queries or administrative interfaces. Preconditions: - An authenticated user with sufficient privileges to delete events in MISP. - The event must have associated reports, graphs, correlations, ssdeep chunks, or attachment scan results. Impact: - Residual sensitive data persists in the database after the parent event is deleted. - Accumulation of orphaned records over time may contribute to storage bloat. - Orphaned records may be inad
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push.CVE-2026-112179 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report. As a result: - All reports except the last one in the set were pushed to the remote MISP instance with their non-exportable tags intact, effectively disclosing restricted tag information to the receiving instance. - When the last report in the set was withheld (empty), a null report was pushed, causing the remote instance to fail saving the event. This issue affects any MISP instance configured to push events with multiple reports to a remote server via synchronization. Affected: <2.5.48.
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.CVE-2026-112178 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. - A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility) - The owning organisation could not view proposals on its own org-only attributes Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions. Affected: <2.5.48
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 19, 2026MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.CVE-2026-112161 · Other software · Mobatek · reported by cve-coordination@incibe.esHigh 8.5
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
Product
MobaXterm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Oct 19, 2026A security flaw has been discovered in DeepPavlov up to 1.7.0.CVE-2026-112098 · Other software · reported by VulDBLow 2.1
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_rCVE-2026-111438 · Other software · openGauss-server · reported by a1a479f7-907b-4ae8-a999-9148cadc9224Medium 6.5
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba 策略完成认证，进而通过复制协议读取备份与日志数据。此问题随 HADR 复制发送方绕过内部连接校验进入代码，自 3.0.0 起即存在。受影响版本包括 3.0.x、3.1.x、5.0.x、5.1.0、6.0.x，以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3。该问题已在 7.0.0-LTS版本修复，通过要求 HADR/SW 复制发送方必须经过 is_node_internal_connection 校验，使外部复制连接改走普通 check_hba() 并触发禁止远程 trust 策略。修复pr见https://gitcode.com/opengauss/openGauss-server/pull/9757。
Product
openGauss-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitcode.com
Oct 19, 2026VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.CVE-2026-104679 · Other software · Yamaha Corporation · reported by vultures@jpcert.or.jpMedium 6.9
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
Product
VOCALOID6 Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp vocaloid.com
Oct 19, 2026A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6.CVE-2026-112094 · Other software · michaelrsweet · reported by VulDBLow 2
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
mxml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-112093 · Other software · subhajitkhan · reported by VulDBLow 2.1
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Product
online-clinic-management-system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.CVE-2026-112092 · Other software · subhajitkhan · reported by VulDBLow 2.1
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Product
online-clinic-management-system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.CVE-2026-112091 · Other software · Dav-ee · reported by VulDBMedium 5.5
A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Product
dairy-management-system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.CVE-2026-112090 · Other software · Dav-ee · reported by VulDBLow 2.1
A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Product
dairy-management-system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 19, 2026在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，CVE-2026-111439 · Other software · openGauss-server · reported by a1a479f7-907b-4ae8-a999-9148cadc9224Medium 4.3
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。
Product
openGauss-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitcode.com
Oct 19, 2026App Builder: Does not require authentication or authorisation before writing attacker-supplied data to one of its options andCVE-2026-94294 · WordPress plugins & themes · reported by WPScanMedium 5.3
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Product
App Builder
Fixed in
5.7.1
What to do
Update App Builder to 5.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Snap Finance: Does not verify that a request to change a WooCommerce order's status comes from an authorised sourceCVE-2026-94272 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Product
Snap Finance
Fixed in
3.12.0
What to do
Update Snap Finance to 3.12.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026TrueBooker: Does not have authorisation checks in place in some of its functionalityCVE-2026-94231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
Product
TrueBooker
Fixed in
1.3.0
What to do
Update TrueBooker to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026TrueBooker: Does not have authorisation checks in some of its AJAX actionsCVE-2026-94230 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
Product
TrueBooker
Fixed in
1.3.0
What to do
Update TrueBooker to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026TrueBooker: Does not verify that the requester owns a booking before rendering its confirmation summaryCVE-2026-94229 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Product
TrueBooker
Fixed in
1.3.0
What to do
Update TrueBooker to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026TrueBooker: Does not perform any capability check on one of its setup handlersCVE-2026-94228 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
Product
TrueBooker
Fixed in
1.3.0
What to do
Update TrueBooker to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Subscribe to Comments: Does not sanitise newline characters from a notification sender-name setting before using it in e-mail headersCVE-2026-91831 · WordPress plugins & themes · reported by WPScanLow 3.8
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
Product
Subscribe to Comments
Fixed in
2.3.3
What to do
Update Subscribe to Comments to 2.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026iPOSpays Payment Gateway for WooCommerce: Does not verify that a payment was actually completed before recording an orderCVE-2026-86791 · WordPress plugins & themes · reported by WPScanMedium 5.3
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
Product
iPOSpays Payment Gateway for WooCommerce
Fixed in
1.4.7
What to do
Update iPOSpays Payment Gateway for WooCommerce to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to exCVE-2026-76740 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.2
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
Product
HPE Compute Scale-up Server 3200 platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.