Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
397,455 results · page 308 of 7950
Oct 14, 2026Sentry is an application monitoring and error tracking platform.CVE-2026-102899 · Other software · getsentry · reported by GitHubHigh 7.6
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-102756 · Other software · dataease · reported by GitHubMedium 5.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-102755 · Other software · dataease · reported by GitHubMedium 5.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Dgraph is an open source distributed GraphQL database.CVE-2026-102748 · Other software · dgraph-io · reported by GitHubCritical 9.2
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
- Product
- dgraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents.CVE-2026-102682 · Other software · pipecat-ai · reported by GitHubMedium 5.6
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default and is intended only for local development, so exploitation requires an operator to expose it to untrusted traffic through --host 0.0.0.0, a published port, or a tunnel without access controls. An unauthenticated caller can consume local resources and third-party quotas and, depending on configuration, receive a room URL and join token. Version 1.6.0 adds a prominent development-runner banner and documentation that clarifies the unauthenticated boundary and directs production deployments to an authenticated dispatcher or managed runtime, while the endpoint behavior remains by design. This issue is fixed in version 1.6.0.
- Product
- pipecat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, tCVE-2026-102479 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) charCVE-2026-102471 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChaCVE-2026-102460 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.6
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated on the routing context by a preceding handler in the request pipeline, ChainAuthHandler skips all scope validation configured via withScope() or withScopes(). This affects both any() and all() chain modes. The root cause is that postAuthentication() relies on internal state that is only set during the authenticate() phase, which is skipped entirely for pre-authenticated users. In any() mode, the absence of this state causes the method to fall through without delegating scope checks to any handler. In all() mode, scope checks are unconditionally skipped. This allows a user with a valid token but insufficient scopes to access resources protected by scope requirements, provided they were authenticated by an earlier handler in the pipeline. The most common trigger is overlapping authentication handlers on nested routes, where a parent route authenticates broadly and a child
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026BentoPDF is a privacy-focused PDF toolkit that runs in the browser.CVE-2026-102354 · Other software · alam00000 · reported by GitHubMedium 6.8
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.
- Product
- bentopdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.CVE-2026-100406 · Other software · dbt-labs · reported by GitHubHigh 8.2
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
- Product
- dbt-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92160 · Other software · nasa · reported by GitHubMedium 6.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a caller able to issue SendPartial supplies a length whose U32 sum with that offset wraps, the first data-packet send reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92159 · Other software · nasa · reported by GitHubMedium 6.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime value fits. When a telemetry update for a configured channel carries a serialized value larger than that channel fixed slot, the copy overwrites adjacent channel fields and causes corrupted packetized telemetry to be emitted. This issue is fixed in version 4.3.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92158 · Other software · nasa · reported by GitHubHigh 7.2
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid. When a sequence-controlled STORE directive supplies a stack offset and size whose U32 sum wraps, memcpy can write outside the sequencer stack, causing memory corruption, denial of service, and potentially code execution. This issue is fixed in version 4.2.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92157 · Other software · nasa · reported by GitHubMedium 6.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset that is inconsistent with m_byteOffset. When an existing source file is larger than a valid startOffset and a SendPartial command supplies a length whose U32 sum with that offset wraps below the file size, under standard F Prime assertion handling, the first data-packet transition reaches FW_ASSERT and aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92156 · Other software · nasa · reported by GitHubMedium 6.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92155 · Other software · nasa · reported by GitHubHigh 7.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its range and FilePacket::fromSerialBuffer reaches a default FW_ASSERT. When a network file packet contains an unknown file-packet type byte, the assertion aborts or resets the default Ref application process, causing denial of service. This issue is fixed in version 4.2.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92154 · Other software · nasa · reported by GitHubHigh 8.1
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing. When a file-uplink DATA packet supplies a byteOffset and dataSize whose unsigned sum wraps below the declared file size, data can be written beyond the declared upload size, causing file integrity loss and potentially large sparse-file growth or resource exhaustion. This issue is fixed in version 4.2.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92152 · Other software · nasa · reported by GitHubCritical 9.3
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.CVE-2026-92150 · Other software · nasa · reported by GitHubHigh 7.5
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow. When an unauthenticated inter-processor hub peer sends a truncated buffer, an invalid HubType, or a header-only command-dispatch payload, malformed hub traffic aborts or resets the process, causing denial of service. This issue is fixed in version 4.2.0.
- Product
- fprime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88164 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in the DPDK nfp vDPA driver.CVE-2026-86856 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost vhost-crypto.CVE-2026-86849 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost vhost-crypto.CVE-2026-86848 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost vhost-crypto.CVE-2026-86847 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost vhost-crypto.CVE-2026-86846 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost vhost-crypto.CVE-2026-86845 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost.CVE-2026-86567 · Other software · Red Hat · reported by Red HatHigh 8.8
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026A flaw was found in DPDK lib/vhost.CVE-2026-86566 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026FV Flowplayer Video Player: Limited Arbitrary File UploadCVE-2026-86461 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.54.7212
- What to do
- Affects up to 7.5.54.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the requCVE-2026-79957 · Other software · ServiceNext · reported by cves@blacklanternsecurity.comHigh 8.1
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.
- Product
- SerTec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blacklanternsecurity.comblog.blacklanternsecurity.com
Oct 14, 2026Redash is a package for data visualization and sharing.CVE-2026-77371 · Other software · getredash · reported by GitHubCritical 9.3
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
- Product
- redash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Redash is a package for data visualization and sharing.CVE-2026-76083 · Other software · getredash · reported by GitHubMedium 4.9
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.
- Product
- redash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026e107 is a content management system (CMS).CVE-2026-55573 · Other software · e107inc · reported by GitHubCritical 9.8
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026e107 is a content management system (CMS).CVE-2026-55572 · Other software · e107inc · reported by GitHubCritical 10
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-54554 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
- Product
- fogproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Redash is a package for data visualization and sharing.CVE-2026-42093 · Other software · getredash · reported by GitHubHigh 8.7
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
- Product
- redash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in evolution-data-server.CVE-2026-110777 · Other software · GNOME · reported by Red HatMedium 5.7
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
- Product
- evolution-data-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.CVE-2026-109527 · Other software · modelcontextprotocol · reported by GitHubHigh 7.5
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.
- Product
- python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Best Payments Plugin for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
- Product
- Best Payments Plugin for WP
- Affected
- up to 4.6.27
- What to do
- Affects up to 4.6.27. Update Best Payments Plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Hippoo Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Skydropx: Missing AuthorizationCVE-2026-108480 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
- Product
- Skydropx
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Skydropx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.CVE-2026-108395 · Other software · modelcontextprotocol · reported by GitHubHigh 7.5
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.
- Product
- io.modelcontextprotocol.sdk:mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Hestia Control Panel is a lightweight and powerful control panel for the modern web.CVE-2026-108390 · Other software · hestiacp · reported by GitHubCritical 9.9
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026MDTF: Improper Control of Generation of Code ('Code Injection')CVE-2026-108151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.
- Product
- MDTF
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other CVE-2026-107350 · Other software · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.CVE-2026-107349 · Other software · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 7.5
An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service whCVE-2026-107348 · Other software · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 5.9
Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is restarted. Since 1.23.0 the overflow is reachable before authentication with a five-byte packet header.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, anCVE-2026-106465 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.9
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.
- Product
- Eclipse ThreadX NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRINGCVE-2026-106464 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.7
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.
- Product
- Eclipse ThreadX NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 14, 2026SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105066 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.
- Product
- SimplyRETS Real Estate IDX
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.