Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
394,398 results · page 220 of 7888
Oct 18, 2026libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkCVE-2026-112052 · Other software · SpatiaLite · reported by VulnCheckMedium 6.9
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash the process or corrupt heap memory on 32-bit builds.
- Product
- libspatialite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via CVE-2026-112051 · Other software · xorbitsai · reported by VulnCheckHigh 8.3
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
- Product
- inference
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because pCVE-2026-112050 · Other software · gitify-app · reported by VulnCheckLow 2.3
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
- Product
- gitify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the instalCVE-2026-112049 · Other software · Vita3K · reported by VulnCheckMedium 6.7
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution.
- Product
- Vita3K
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation viaCVE-2026-112048 · Other software · SpatiaLite · reported by VulnCheckMedium 6.9
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on 32-bit builds.
- Product
- libspatialite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scoCVE-2026-112047 · Other software · OneUptime · reported by VulnCheckMedium 5.3
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methoCVE-2026-112046 · Other software · OW2 · reported by VulnCheckMedium 6.8
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to build tools, instrumenters, agents, or analyzers.
- Product
- ASM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasm.ow2.iogitlab.ow2.org
Oct 18, 2026A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.CVE-2026-111986 · Other software · AUTOMATIC1111 · reported by VulDBLow 2.1
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- stable-diffusion-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.CVE-2026-78497 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.4
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs without `use re 'eval'`. Single quotes in the pattern are escaped, but a code block runs in place and needs none. An attacker who supplies a query, or text that an application inserts into the pattern of one, can execute arbitrary Perl code in the calling process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 18, 2026snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memoCVE-2026-112021 · Other software · grunfink · reported by VulnCheckHigh 8.7
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
- Product
- snac2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orgcodeberg.org
Oct 18, 2026LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks onCVE-2026-112020 · Other software · lvandeve · reported by VulnCheckMedium 6.9
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash applications.
- Product
- lodepng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferVCVE-2026-112019 · Other software · jkuhlmann · reported by VulnCheckMedium 6.9
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash applications.
- Product
- cgltf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer CVE-2026-112018 · Other software · jkuhlmann · reported by VulnCheckHigh 7.3
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.
- Product
- cgltf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by insertingCVE-2026-112017 · Other software · jeecgboot · reported by VulnCheckHigh 7.1
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to oCVE-2026-112016 · Other software · Netcore · reported by VulnCheckMedium 6.9
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.
- Product
- NR256CN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 18, 2026Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested subCVE-2026-112015 · Other software · omnigent-ai · reported by VulnCheckHigh 7.7
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.
- Product
- omnigent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant CVE-2026-112014 · Other software · netease-youdao · reported by VulnCheckMedium 6.8
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
- Product
- LobsterAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidateCVE-2026-112013 · Other software · True Audio · reported by VulnCheckMedium 6.8
libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.
- Product
- libtta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header chCVE-2026-112012 · Other software · True Audio · reported by VulnCheckMedium 4.8
libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.
- Product
- libtta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit buiCVE-2026-112011 · Other software · True Audio · reported by VulnCheckMedium 5.8
libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.
- Product
- libtta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an uCVE-2026-112010 · Other software · icculus · reported by VulnCheckMedium 6.8
smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or out-of-bounds copy, crashing the application.
- Product
- smpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supCVE-2026-112009 · Other software · icculus · reported by VulnCheckMedium 6.8
smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications opening it through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.
- Product
- smpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffCVE-2026-112008 · Other software · libmng · reported by VulnCheckMedium 6.9
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.
- Product
- libmng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackmd.iosourceforge.net
Oct 18, 2026Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample coCVE-2026-112007 · Other software · schismtracker · reported by VulnCheckMedium 6.9
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen pointers and crash the application.
- Product
- Schism Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verificatioCVE-2026-112006 · Other software · OpenTelemetry · reported by VulnCheckHigh 8.3
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
- Product
- opentelemetry-exporter-otlp-proto-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesCVE-2026-112005 · Other software · clidey · reported by VulnCheckCritical 9.2
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
- Product
- whodb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplCVE-2026-112004 · Other software · teableio · reported by VulnCheckLow 2.3
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.
- Product
- teable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat trackeCVE-2026-112003 · Other software · ProjectSend · reported by VulnCheckMedium 6
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accCVE-2026-112002 · Other software · ProjectSend · reported by VulnCheckHigh 7.6
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentialCVE-2026-112001 · Other software · ProjectSend · reported by VulnCheckHigh 8.6
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregisteCVE-2026-112000 · Other software · vanus-labs · reported by VulnCheckHigh 7.2
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
- Product
- vanus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus throughCVE-2026-111999 · Other software · vanus-labs · reported by VulnCheckHigh 8.7
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
- Product
- vanus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the haCVE-2026-111998 · Other software · vanus-labs · reported by VulnCheckCritical 9.3
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- Product
- vanus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.CVE-2026-111985 · Other software · AUTOMATIC1111 · reported by VulDBLow 2.1
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- stable-diffusion-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.CVE-2026-111984 · Other software · AUTOMATIC1111 · reported by VulDBLow 2.1
A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- stable-diffusion-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110897 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.
- Product
- PowerPack Lite for Beaver Builder
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PowerPack Lite for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-110895 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.
- Product
- Support Genix
- Affected
- up to 1.4.54
- What to do
- Affects up to 1.4.54. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Conversational Forms for ChatBot: Deserialization of Untrusted DataCVE-2026-110886 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
- Product
- Conversational Forms for ChatBot
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026HivePress: Improper Control of Generation of Code ('Code Injection')CVE-2026-110885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
- Product
- HivePress
- Affected
- up to 1.7.32
- What to do
- Affects up to 1.7.32. Update HivePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 20262Way VideoCalls and Random Chat: Authentication Bypass by Primary WeaknessCVE-2026-110883 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
- Product
- 2Way VideoCalls and Random Chat
- Affected
- up to 6.1.5
- What to do
- Affects up to 6.1.5. Update 2Way VideoCalls and Random Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Kit (formerly ConvertKit): Missing AuthorizationCVE-2026-110880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
- Product
- Kit (formerly ConvertKit)
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update Kit (formerly ConvertKit) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Electronic Signature Add-on for Fluent Forms: Authorization Bypass Through User-Controlled KeyCVE-2026-110383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
- Product
- Electronic Signature Add-on for Fluent Forms
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Electronic Signature Add-on for Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Simply Schedule Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.35
- What to do
- Affects up to 1.6.12.35. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Login with phone number: Incorrect Privilege AssignmentCVE-2026-110373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
- Product
- Login with phone number
- Affected
- up to 1.8.77
- What to do
- Affects up to 1.8.77. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026OttoKit: Incorrect Privilege AssignmentCVE-2026-110372 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
- Product
- OttoKit
- Affected
- up to 1.1.40
- What to do
- Affects up to 1.1.40. Update OttoKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Advanced File Manager: Missing AuthorizationCVE-2026-110365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
- Product
- Advanced File Manager
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Booktics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-109895 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
- Product
- Booktics
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109894 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
- Product
- Booktics
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026eStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108485 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.
- Product
- eStore
- Affected
- up to 1.6.13
- What to do
- Affects up to 1.6.13. Update eStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Strong Testimonials: Deserialization of Untrusted DataCVE-2026-107436 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
- Product
- Strong Testimonials
- Affected
- up to 3.3.12
- What to do
- Affects up to 3.3.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.