Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,189 results · page 3 of 584
Oct 27, 2026Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly ConstraineCVE-2026-16307 · Other software · Netiket Information Technologies · reported by iletisim@usom.gov.trMedium 4.3
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
- Product
- EdoWEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Information disclosure in the Networking: DNS component.CVE-2026-118003 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Information disclosure due to race condition in the Networking component.CVE-2026-118002 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Information disclosure in the Networking: HTTP component.CVE-2026-118000 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Use-after-free in the Networking: DNS component.CVE-2026-117973 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Site isolation issue in the Networking: HTTP component.CVE-2026-117966 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Site isolation issue in the Networking: HTTP component.CVE-2026-117958 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Cryptographic issue in the WebRTC: Networking component.CVE-2026-117957 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Uninitialized memory in the Networking component.CVE-2026-117952 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Use-after-free in the Networking: WebSockets component.CVE-2026-117922 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Use-after-free in the Networking component.CVE-2026-117907 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Use-after-free in the Networking: HTTP component.CVE-2026-117899 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to use-after-free in the WebRTC: Networking component.CVE-2026-117892 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Use-after-free in the Networking component.CVE-2026-117884 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Sandbox escape in the DOM: Networking component.CVE-2026-117868 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Privilege escalation due to incorrect boundary conditions in the Networking component.CVE-2026-117862 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc.CVE-2026-92546 · Other software · Keepnet Labs Cybersecurity Inc. · reported by iletisim@usom.gov.trHigh 7.5
Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.
- Product
- Agentic AI / Agentic Ally
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only frCVE-2026-10756 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.7
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
- Product
- TRO600 Series Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Oct 27, 2026A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device CVE-2026-106174 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 27, 2026Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive informCVE-2026-105946 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 5.3
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.
- Product
- qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgcodereview.qt-project.org
Oct 26, 2026A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitCVE-2026-116837 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 8.8
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.
- Product
- airMAX M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMCVE-2026-116836 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984High 8.8
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
- Product
- airMAX M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-coCVE-2026-76654 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 5.8
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Oct 26, 2026A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision oCVE-2026-2270 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 5.9
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Product
- Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Oct 26, 2026libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying meCVE-2026-116740 · Other software · netsurf-browser · reported by VulnCheckHigh 7.1
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
- Product
- libcss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Tornado is a Python web framework and asynchronous networking library.CVE-2026-116578 · Other software · tornadoweb · reported by GitHubLow 2.1
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Tornado is a Python web framework and asynchronous networking library.CVE-2026-116577 · Other software · tornadoweb · reported by GitHubMedium 5.3
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2.CVE-2026-116477 · Other software · a2aproject · reported by VulDBMedium 5.3
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
- Product
- a2a-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Tornado is a Python web framework and asynchronous networking library.CVE-2026-115927 · Other software · tornadoweb · reported by GitHubMedium 5.3
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3.CVE-2026-116476 · Other software · a2aproject · reported by VulDBMedium 5.3
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
- Product
- a2a-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximuCVE-2026-72758 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable.CVE-2026-72757 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 5.3
Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. This only affects users that make their HTTP or RTR server available to untrusted networks.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names thCVE-2026-72756 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validationCVE-2026-72755 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlLow 3.8
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026When Routinator encounters a CRL with many entries, it may hang or run out of memory.CVE-2026-72754 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data.CVE-2026-72753 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.2
When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Routinator runs out of memory when the JSON output is requested many times concurrently.CVE-2026-72752 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.5
Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server. Additionally Routinator runs into a stack overflow and exits when a payload item with too much metadata is discarded at once. This only affects users that make their HTTP or RTR server available to untrusted networks.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.CVE-2026-115922 · Other software · onnx · reported by GitHubMedium 6.2
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.
- Product
- onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.CVE-2026-115921 · Other software · onnx · reported by GitHubMedium 6.2
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
- Product
- onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.CVE-2026-115920 · Other software · onnx · reported by GitHubMedium 6.2
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.
- Product
- onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.CVE-2026-115919 · Other software · onnx · reported by GitHubMedium 6.2
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
- Product
- onnx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator.CVE-2026-102649 · Other software · padok-team · reported by GitHubCritical 9.9
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, ex
- Product
- burrito
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 tCVE-2026-19742 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 3.7
The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get(). That API is documented as not cryptographically secure, while both RFCs require this key to be an unpredictable random value of at least 128 bits — the unpredictability of every generated IID rests entirely on it. Depending on the platform, sys_rand_get() resolves either to a hardware entropy device or, on boards whose entropy driver sets CONFIG_ENTROPY_NEEDS_PRNG, to the non-cryptographic xoshiro128++ generator in subsys/random/random_xoshiro128.c, which keeps a single global 128-bit state shared with every other sys_rand_get() consumer. Many of those consumers put their output directly on the wire (ephemeral source ports, DNS query IDs, CoAP message IDs and tokens, DHCPv6 transaction IDs, WebSocket masking keys), and the xoshiro state transition is invertible, so an observer of a device's traffic can recover the generator state and reconstruct the IID secret key. Additionally, with the entropy-device backend sys_rand_get()
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NCVE-2026-116542 · Other software · netty · reported by VulnCheckMedium 6.9
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
- Product
- netty-tcnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes conCVE-2026-116541 · Other software · netty · reported by VulnCheckHigh 8.2
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
- Product
- netty-tcnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticCVE-2026-116540 · Other software · netty · reported by VulnCheckHigh 8.2
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
- Product
- netty-tcnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap theCVE-2026-116539 · Other software · netty · reported by VulnCheckHigh 8.2
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
- Product
- netty-tcnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 CVE-2026-99088 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDR_FRAGMENT and returns early without calling skb_set_transport_header(). update_ipv6_checksum() unconditionally evaluates skb_transport_offset() on entry before checking l4_proto. Because skb->transport_header is uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although it is completely harmless. Fix this by returning early in update_ipv6_checksum() if l4_proto is NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing. See the syzbot trace: !skb_transport_header_was_set(skb) WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [in
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 26, 2026An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSCVE-2026-107656 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
- Product
- FortiSandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 26, 2026SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to wriCVE-2026-70388 · Other software · RT-Labs AB · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.3
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.
- Product
- SOEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.