Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

394,547 results · page 231 of 7891

Oct 16, 2026An issue was discovered in GStreamer gst-plugins-good before 1.28.2.CVE-2026-46471 · Other software · reported by MITREMedium 5.5
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gstreamer.freedesktop.org
Oct 16, 2026countly-server is the server-side part of Countly, a product analytics solution.CVE-2026-44977 · Other software · Countly · reported by GitHubCritical 9
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
Product
countly-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026countly-server is the server-side part of Countly, a product analytics solution.CVE-2026-42270 · Other software · Countly · reported by GitHubHigh 7.5
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Product
countly-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026countly-server is the server-side part of Countly, a product analytics solution.CVE-2026-42269 · Other software · Countly · reported by GitHubHigh 8.1
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
Product
countly-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026countly-server is the server-side part of Countly, a product analytics solution.CVE-2026-41582 · Other software · Countly · reported by GitHubHigh 7.5
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Product
countly-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe cCVE-2026-26846 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com weinview.cn
Oct 16, 2026A flaw was found in libblockdev.CVE-2026-111581 · Other software · Red Hat · reported by Red HatLow 3.3
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 16, 2026The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.CVE-2026-102941 · Other software · gomarkdown · reported by GitHubHigh 7.5
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.
Product
markdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.CVE-2026-102923 · Other software · CodeWithCJ · reported by GitHubMedium 5.4
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.
Product
SparkyFitness
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states.CVE-2026-97851 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.8
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external CVE-2026-95183 · Other software · reported by MITREHigh 8.8
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deepseek.com gist.github.com
Oct 16, 2026An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable filesCVE-2026-95182 · Other software · reported by MITRECritical 10
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deepseek.com gist.github.com
Oct 16, 2026Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly CVE-2026-88755 · Other software · reported by MITREHigh 7.8
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zai.com zcode.com
Oct 16, 2026Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clientsCVE-2026-111728 · Other software · 5rahim · reported by VulnCheckMedium 5.3
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.
Product
Seanime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent ServeCVE-2026-107777 · Other software · Thermo Fisher · reported by ics-cert@hq.dhs.govHigh 7.1
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.
Product
Torrent Suite Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documents.thermofisher.com github.com
Oct 16, 2026JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.CVE-2026-107621 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.7
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.CVE-2026-106705 · Other software · reported by MITREHigh 8.8
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.CVE-2026-105667 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.7
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026In the default configuration, the archive accepts DICOM associations from an unregistered calling AE.CVE-2026-105279 · Other software · J4Care · reported by ics-cert@hq.dhs.govCritical 9.3
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026MP4Parser does not adequately validate MP4 box sizes.CVE-2026-105273 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.7
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying.CVE-2026-101021 · Other software · J4Care · reported by ics-cert@hq.dhs.govHigh 8.7
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
Product
dcm4chee-arc-light
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 16, 2026Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input frCVE-2025-52097 · Other software · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record instantasp.com instantforumnet.com
Oct 16, 2026An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device isCVE-2026-97858 · Other software · Guangzhou Juan IoT Technology Co., Ltd. · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
Product
EseeCloud App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eseecloud.app github.com
Oct 16, 2026Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental: Stored Cross-Site ScriptingCVE-2026-97470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.
Product
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSSCVE-2026-90821 · Other software · Arcadia Technology, LLC · reported by cve@gitlab.comMedium 5.4
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input
Product
Crafty Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Oct 16, 2026An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scriptiCVE-2026-18516 · Other software · Arcadia Technology, LLC · reported by cve@gitlab.comCritical 9.6
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
Product
Crafty Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com
Oct 16, 2026aThemeArt Theme Helper: Cross-Site Request Forgery (CSRF)CVE-2026-111413 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.
Product
aThemeArt Theme Helper
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update aThemeArt Theme Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-oCVE-2026-110806 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Oct 16, 2026Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate thCVE-2026-110805 · Other software · Devolutions · reported by security@devolutions.netLow 2.6
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Oct 16, 2026Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM CVE-2026-110804 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Oct 16, 2026Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit aCVE-2026-110287 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Oct 16, 2026An attacker can use a hard-coded credential to log in to EseeCloud devices.CVE-2026-107617 · Other software · Guangzhou Juan IoT Technology Co., Ltd. · reported by ics-cert@hq.dhs.govCritical 9.3
An attacker can use a hard-coded credential to log in to EseeCloud devices.
Product
EseeCloud App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eseecloud.app github.com
Oct 16, 2026The endpoint exposes an observable response discrepancy when processing ID values.CVE-2026-105664 · Other software · Guangzhou Juan IoT Technology Co., Ltd. · reported by ics-cert@hq.dhs.govMedium 6.9
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization - to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.
Product
EseeCloud App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eseecloud.app github.com
Oct 16, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.CVE-2026-68571 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 16, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache KylinCVE-2026-64959 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 16, 2026Deserialization of Untrusted Data vulnerability in Apache Kylin.CVE-2026-64610 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 16, 2026Missing Authorization vulnerability in Apache Kylin.CVE-2026-63619 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 16, 2026Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.CVE-2026-63618 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Product
Apache Kylin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 16, 2026A flaw was found in luksmeta.CVE-2026-111555 · Other software · Red Hat · reported by Red HatMedium 6
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 16, 2026YITH PayPal Express Checkout for WooCommerce: Missing AuthorizationCVE-2026-111409 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
Product
YITH PayPal Express Checkout for WooCommerce
Affected
up to 1.61.0
What to do
Affects up to 1.61.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111405 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.
Product
MapSVG
Affected
up to 8.16.1
What to do
Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Product
PowerPack Addons for Elementor
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026MapSVG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111399 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.
Product
MapSVG
Affected
up to 8.16.1
What to do
Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026MapSVG: Missing AuthorizationCVE-2026-111397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.
Product
MapSVG
Affected
up to 8.16.1
What to do
Affects up to 8.16.1. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Advanced Post Manager: Missing AuthorizationCVE-2026-111396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.
Product
Advanced Post Manager
Affected
up to 4.5.6
What to do
Affects up to 4.5.6. Update Advanced Post Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110903 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.
Product
The Events Calendar
Affected
up to 6.18.1
What to do
Affects up to 6.18.1. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026SmartCrawl: Authorization Bypass Through User-Controlled KeyCVE-2026-110901 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Product
SmartCrawl
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update SmartCrawl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026BookIt: Missing AuthorizationCVE-2026-110900 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
Product
BookIt
Affected
up to 2.6.0.5
What to do
Affects up to 2.6.0.5. Update BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026Passster: Missing AuthorizationCVE-2026-110896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.
Product
Passster
Affected
up to 4.3.18
What to do
Affects up to 4.3.18. Update Passster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2026WP Event Solution: Missing AuthorizationCVE-2026-110380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
Product
WP Event Solution
Affected
up to 4.1.26
What to do
Affects up to 4.1.26. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.