Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,077 results · page 3 of 42
Sep 10, 2026Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured fileCVE-2026-88029 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.1
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
- Product
- Python Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file ideCVE-2026-88025 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.1
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
- Product
- C# Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file iCVE-2026-88024 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.1
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
- Product
- Rust Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file iCVE-2026-88023 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.1
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
- Product
- MongoDB PHP Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability.CVE-2026-81052 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution.
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability.CVE-2026-81049 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
- Product
- ThinOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity CheCVE-2026-79963 · Other software · Dell · reported by security_alert@emc.comHigh 7.4
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.
- Product
- Secure Connect Gateway 5.0 - Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification.CVE-2026-78574 · Other software · Okta · reported by psirt@okta.comHigh 7.5
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer.
- Product
- Okta Hyperdrive Integration Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered tCVE-2026-81824 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.3
The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.
- Product
- Pipeline Integrity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in informationCVE-2026-81823 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.9
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.
- Product
- Pipeline Integrity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords tCVE-2026-81822 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.3
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.
- Product
- Pipeline Integrity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.CVE-2026-81821 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 8.3
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.
- Product
- Pipeline Integrity Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-72929 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper validation of integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavascrCVE-2026-78838 · Other software · reported by MITREMedium 6.5
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 7, 2026Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the eCVE-2026-18796 · Other software · Nordic Semiconductor ASA · reported by 30a5e7fb-040d-440a-8cdf-a4a2068ce72eMedium 6.8
Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK version is the root cause; the weakness is in the on-the-fly decryption scheme.
- Product
- nRF5340
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checkCVE-2026-86185 · Other software · Bilibili · reported by VulnCheckHigh 8.6
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
- Product
- Bilibili Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.bilibili.comgithub.com
Sep 5, 2026Post Grid and Gutenberg Blocks – ComboBlocks: Unauthenticated Hook InjectionCVE-2024-11080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
- Product
- Post Grid and Gutenberg Blocks – ComboBlocks
- Affected
- 2.2.32 to 2.3.1
- What to do
- Affects 2.2.32 to 2.3.1. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.CVE-2026-17207 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical funCVE-2026-17057 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive MetastCVE-2026-52691 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Griffin Hive Metastore Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 3, 2026MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fCVE-2026-85452 · Other software · themoos · reported by VulnCheckHigh 8.7
MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.
- Product
- ui-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline.CVE-2026-85181 · Other software · dianping · reported by VulnCheckCritical 9.3
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
- Product
- cat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may alCVE-2026-19219 · Other software · Progress Software · reported by security@progress.comHigh 8.1
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.
- Product
- Telerik UI for ASP.NET AJAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Incorrect boundary conditions in the Layout: Grid component.CVE-2026-84126 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 30, 2026Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind anCVE-2026-75757 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.3
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality. This issue affects ash_admin: from 0.9.1 before 1.3.1.
- Product
- ash_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 28, 2026StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulneraCVE-2026-22056 · Other software · NetApp · reported by security-alert@netapp.comLow 2.3
StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.
- Product
- StorageGRID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks.CVE-2026-59286 · Other software · Spring · reported by security@vmware.comHigh 8.1
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Product
- Spring for GraphQL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sCVE-2026-21810 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.4
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
- Product
- BigFix Quantum Risk Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 25, 2026NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check.CVE-2026-65097 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
- Product
- NemoClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 22, 2026Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2026-4559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.12
- What to do
- Affects up to 3.6.12. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screenCVE-2026-16260 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
- Product
- Post Grid, Slider & Carousel Ultimate
- Fixed in
- 1.8.1
- What to do
- Update Post Grid, Slider & Carousel Ultimate to 1.8.1 or newer.
Aug 20, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-boundCVE-2026-17003 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integriCVE-2026-76354 · Other software · Splunk · reported by psirt@cisco.comHigh 8.1
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member. The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path. For more information see About search head clustering (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-search-head-clustering/about-search-head-clustering), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and Secure Splunk Enterprise service accounts (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.0/install-splunk-ente
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulneraCVE-2026-22306 · Other software · Ozols Grupa · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 10
Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.
- Product
- OZOLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check timCVE-2026-16819 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The Grid: Incorrect Privilege AssignmentCVE-2026-28191 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.CVE-2026-23937 · Other software · Zabbix · reported by security@zabbix.comMedium 6
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trCVE-2026-74882 · Other software · jahlives · reported by VulnCheckHigh 8.7
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tCVE-2026-72101 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tuple size, dm-integrity is supposed to zero the remaining space. There was a bug in the code that zeroing didn't work. This commit fixes it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm_integrity_check_limits fails, thCVE-2026-72100 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm_integrity_check_limits fails, the code would exit with DM_MAPIO_KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a deadlock. Let's move the limit check up, so that when it exits, no resources are leaked.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash_offset twice hash_offset is already incremented in the CVE-2026-72099 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash_offset twice hash_offset is already incremented in the loop "for (i = 0; i < to_copy; i++, ts--)". Do not increment it again.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2026ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to executeCVE-2026-53970 · Other software · lucasgelfond · reported by VulnCheckHigh 7.5
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-controlled build steps or source tree modifications that execute during source builds via 'zb install --build-from-source' without any integrity warning.
- Product
- ZeroBrew
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.CVE-2026-65580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS cCVE-2026-14681 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.2
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
- Product
- Postgresql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injectionCVE-2026-18098 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availabilitCVE-2026-69105 · Other software · jfrog · reported by reefs@jfrog.comHigh 8.1
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Aug 12, 2026CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity chCVE-2025-59324 · Other software · reported by MITRECritical 9.1
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi.blackhat.comi.blackhat.com
Aug 12, 2026CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing cCVE-2025-59323 · Other software · reported by MITREHigh 8.4
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details. Crafted DataStore contents can impact service availability and/or allow for code execution in the context of high privilege.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi.blackhat.comi.blackhat.com
Aug 12, 2026CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matchCVE-2025-59319 · Other software · reported by MITREHigh 7.2
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi.blackhat.comi.blackhat.com
Aug 12, 2026wpmudev-updates: Does not verify the integrity of the packages installed through its remote management interfaceCVE-2026-16051 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).
- Product
- wpmudev-updates
- Fixed in
- 5.0.1
- What to do
- Update wpmudev-updates to 5.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.