Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,174 results · page 32 of 304
Jul 20, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-55831 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Flask-Security-Too allows users to add security features to their Flask applicationa.CVE-2026-46715 · Other software · pallets-eco · reported by GitHubMedium 5.3
Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.
- Product
- Flask-Security-Too
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026Parsec is a cloud-based application for simple and cryptographically secure file sharing.CVE-2026-25039 · Other software · Scille · reported by GitHubHigh 8.8
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.
- Product
- parsec-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup.CVE-2026-16247 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6High 7.3
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool.
- Product
- _connect.BRAIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup.CVE-2026-16246 · Other software · Bizerba SE & Co. KG · reported by 0beee27a-7d8c-424f-8e46-ac453fa147e6High 7.3
In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11.
- Product
- BRAIN2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-54335 · Other software · feathersjs · reported by GitHubLow 3.7
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__, constructor, or prototype key, that key is returned as an own-enumerable property; the recursive merge then resolves target['__proto__'] to Object.prototype and writes attacker-supplied properties onto it, polluting the prototype for all plain objects in the process for the lifetime of the Node process. This issue is fixed in version 5.0.45.
- Product
- feathers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026secure_headers manages application of security headers with many safe defaults.CVE-2026-54163 · Other software · github · reported by GitHubMedium 4.7
secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives with ; separators, and build_sandbox_list_directive, build_media_type_list_directive, and build_report_to_directive interpolate caller-supplied strings without scrubbing ;, \r, or \n. When untrusted input reaches SecureHeaders.override_content_security_policy_directives or append APIs for :sandbox, :plugin_types, or :report_to, an attacker can inject a CSP directive such as script-src 'unsafe-inline' * before the legitimate script-src, enabling XSS reachability through these sinks or CSP report exfiltration. This issue is fixed in version 7.3.0.
- Product
- secure_headers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring.CVE-2026-50274 · Other software · DataDog · reported by GitHubHigh 7.5
Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption and enabling a remote denial of service against HTTP services with baggage propagation enabled. This issue is fixed in version 2.8.1.
- Product
- dd-trace-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44891 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request.CVE-2026-9171 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
- Product
- PowerVM Novalink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Datadog .NET Tracer is a client library for Datadog APM for .NET applications.CVE-2026-50273 · Other software · DataDog · reported by GitHubHigh 7.5
Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or one very large value and cause unbounded CPU and memory consumption in services with baggage propagation enabled. This issue is fixed in version 3.43.0.
- Product
- dd-trace-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows acceCVE-2024-23578 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.2
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol.CVE-2024-23577 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server.CVE-2024-23575 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13.CVE-2024-23573 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.7
HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its foCVE-2024-23571 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in aCVE-2024-23570 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forgery, sensitive information leakage and more.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server.CVE-2024-23568 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated software version is in use with published vulnerabilities.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normalCVE-2024-23567 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented.CVE-2024-23566 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality.CVE-2024-23565 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.3
HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirecCVE-2024-23564 · Other software · HCL Software · reported by psirt@hcl.comCritical 9.1
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.
- Product
- Aftermarket EPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 17, 2026HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2026-21770 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
- Product
- HCL Traveler for Microsoft Outlook (HTMO)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 16, 2026Docling Core defines core data types and transformations for the document processing application Docling.CVE-2026-44023 · Other software · docling-project · reported by GitHubHigh 8.6
Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.
- Product
- docling-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Docling Core defines core data types and transformations for the document processing application Docling.CVE-2026-44019 · Other software · docling-project · reported by GitHubHigh 8.1
Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads. This issue has been fixed in version 2.74.1.
- Product
- docling-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026bunkerweb is an Open-source and next-generation Web Application Firewall (WAF).CVE-2026-61718 · Other software · bunkerity · reported by GitHubMedium 5.4
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @login_required, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.
- Product
- bunkerweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026bunkerweb is an Open-source and next-generation Web Application Firewall (WAF).CVE-2026-54728 · Other software · bunkerity · reported by GitHubMedium 6.1
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.
- Product
- bunkerweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS).CVE-2026-15352 · Other software · NASA · reported by ics-cert@hq.dhs.govHigh 8.2
A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.
- Product
- Core Flight System (cFS) Health & Safety (HS) Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing.CVE-2026-46336 · Other software · manyfold3d · reported by GitHubHigh 7.1
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.
- Product
- manyfold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the ChineseCVE-2026-9046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.
- Product
- Legion Zone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Gestor de Oferta is a web application for managing mobility service offerings.CVE-2026-45325 · Other software · tmlmobilidade · reported by GitHubHigh 8.2
Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.
- Product
- go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions.CVE-2026-57206 · Computers, phones & browsers · microsoft · reported by GitHubHigh 8.6
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single_app/plugin_validation_endpoint.py, including `POST /api/admin/plugins/test-instantiation`, `GET /api/admin/plugins/health-check/<plugin_name>`, `POST /api/admin/plugins/repair/<plugin_name>`, and `POST /api/plugins/validate`, relied on @swagger_route(security=get_auth_security()) documentation without enforcing @login_required, @user_required, or @admin_required at runtime, allowing unauthenticated or unauthorized clients to invoke plugin validation, health, and repair behavior. This issue is fixed in version 0.241.206.
- Product
- simplechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions.CVE-2026-57205 · Computers, phones & browsers · microsoft · reported by GitHubMedium 4.3
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address, display name, and profile image. This issue is fixed in version 0.241.203.
- Product
- simplechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modificatiCVE-2026-26718 · Other software · reported by MITRECritical 9.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comxxl-job-admin.com
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-55410 · Other software · nocobase · reported by GitHubMedium 6.7
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-52888 · Other software · nocobase · reported by GitHubMedium 6.8
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete keyword blacklist that did not restrict PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity, allowing an admin-role user to read password hashes and database metadata through the SQL Collection feature. This vulnerability is fixed in 2.1.0-alpha.46.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.CVE-2026-52887 · Other software · nocobase · reported by GitHubCritical 10
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.
- Product
- nocobase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database servCVE-2026-46421 · Other software · cap-js · reported by GitHubCritical 9.3
The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-service@2.10.1` were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. User should upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials. No known workarounds are available.
- Product
- @cap-js/sqlite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-61643 · Other software · labring · reported by GitHubMedium 5.9
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-<victim_toolset_app_id>/<tool_name>. The normal toolset routes deny access, but the workflow save and runtime path did not apply the same authorization check to the referenced toolset, allowing /api/v2/chat/completions to resolve the saved reference and execute the victim-owned HTTP tool. This issue is fixed in version 4.15.0-beta5.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-50562 · Other software · labring · reported by GitHubCritical 9.3
FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.CVE-2026-41580 · Other software · Stirling-Tools · reported by GitHubMedium 6.1
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
- Product
- Stirling-PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-61684 · Other software · labring · reported by GitHubHigh 8.8
FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by verifying a JWT signed with INVOKE_TOKEN_SECRET, which defaults to the constant string token and was not set in official deployment templates. An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cross-tenant user PII by attacker-supplied tmbId values, or /api/invoke/fileUpload to write attacker-controlled content into chat files. This issue is fixed in version 4.15.0-beta5.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-61646 · Other software · labring · reported by GitHubMedium 6.3
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that the guard would block on direct request, and the HTTP node returns the response body to the workflow caller. This issue is fixed in version 4.15.0-beta5.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-61644 · Other software · labring · reported by GitHubHigh 7.7
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collectionId values while supplying another tenant's dataset data id as initialId, causing the response to include foreign dataset quote or full-text content. This issue is fixed in version 4.15.0-beta5.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.CVE-2026-48357 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service.CVE-2026-48354 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.CVE-2026-48352 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.CVE-2026-48351 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.CVE-2026-48302 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service.CVE-2026-48298 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.