Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,302 results · page 26 of 767
Oct 7, 2026The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.CVE-2025-70520 · Other software · reported by MITRECritical 9.8
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.fanvil.comdarkpoint.ca
Oct 7, 2026The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.CVE-2025-70518 · Other software · reported by MITRECritical 10
The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.fanvil.comdarkpoint.ca
Oct 7, 2026The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.CVE-2025-70516 · Other software · reported by MITRECritical 9.1
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.fanvil.comdarkpoint.ca
Oct 7, 2026Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local bCVE-2026-107194 · Other software · Sungrow · reported by MITRECritical 9.2
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
- Product
- iSolarCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjakkaru.desungrowpower.com
Oct 7, 2026llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to cCVE-2026-107183 · Other software · ggml-org · reported by VulnCheckCritical 9.2
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.CVE-2026-102255 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 10
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
- Product
- SMA1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Oct 7, 2026A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or CVE-2026-96408 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
- Product
- Movable Type Cloud Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks.CVE-2026-105192 · Other software · LMCache · reported by reefs@jfrog.comCritical 9.8
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The decode path shipped in v0.3.9 and is present through v0.5.5, including the v0.5.6 release candidates. v0.5.6, published on 2026-10-14, removes pickle.loads from this path.
- Product
- LMCache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.lmcache.aigithub.com
Oct 7, 2026Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resCVE-2026-97720 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
- Product
- Apache Impala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 7, 2026This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality.CVE-2026-107104 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint.CVE-2026-107103 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint.CVE-2026-107102 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
- Product
- Multi-tenant ERP System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cachCVE-2026-103416 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPassCVE-2026-102782 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.CVE-2025-64393 · Other software · Veeam · reported by support@hackerone.comCritical 9.4
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- Product
- Backup and Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026VMware Workstation and Fusion contain an integer-overflow vulnerability.CVE-2026-59346 · Other software · VMware · reported by security@vmware.comCritical 9.3
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
- Product
- VMware Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026A security vulnerability has been identified in FlexNet Publisher lmadmin.CVE-2026-19572 · Other software · Flexera · reported by PSIRT-CNA@flexerasoftware.comCritical 9.3
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.
- Product
- FlexNet Publisher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.revenera.com
Oct 6, 2026wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange.CVE-2026-16516 · Other software · wolfSSL Inc. · reported by facts@wolfssl.comCritical 9
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
- Product
- wolfSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, moCVE-2026-14911 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.3
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload tCVE-2026-19386 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.3
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system.CVE-2026-105324 · Network & remote access · ASUSTOR Inc. · reported by security@asustor.comCritical 9.2
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
- Product
- ADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS cCVE-2026-93674 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.CVE-2026-104334 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106501 · Other software · backstage · reported by GitHubCritical 9.6
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh toCVE-2026-101023 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject.CVE-2026-95106 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author.CVE-2026-94205 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.8
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026An authenticated path traversal vulnerability exists in ClearPass Policy Manager.CVE-2026-79805 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attCVE-2026-79801 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to coCVE-2026-79798 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.9
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to ciCVE-2026-79796 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injeCVE-2026-79794 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.1
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against theCVE-2026-76754 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrCVE-2026-76753 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager.CVE-2026-76752 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager.CVE-2026-76751 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager.CVE-2026-76750 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Buffer overflow vulnerabilities exist in the affected interface of AOS-S.CVE-2026-76747 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.1
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An unauthenticated buffer overflow vulnerability exists in AOS-S.CVE-2026-76746 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker.CVE-2026-76745 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Buffer overflow vulnerabilities exist in the affected interface of AOS-S.CVE-2026-76744 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existingCVE-2026-76743 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Authentication bypass vulnerabilities exist in the web management interface of AOS-S.CVE-2026-76742 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
- Product
- AOS-Switch (AOS-S)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor.CVE-2026-73278 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.8
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026Handlebars provides the power necessary to let users build semantic templates.CVE-2026-106446 · Other software · handlebars-lang · reported by GitHubCritical 9.8
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.
- Product
- handlebars.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Handlebars provides the power necessary to let users build semantic templates.CVE-2026-106445 · Other software · handlebars-lang · reported by GitHubCritical 9.2
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
- Product
- handlebars.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded conCVE-2026-103059 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.1
When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 6, 2026On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints.CVE-2026-102167 · Other software · Arista Networks · reported by psirt@arista.comCritical 9
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway servicCVE-2026-102162 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.4
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services.CVE-2026-102159 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.3
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
- Product
- CloudVision CUE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.