Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
397,870 results · page 323 of 7958
Oct 14, 2026Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting usCVE-2026-59766 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 4.3
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026util-linux is a random collection of Linux utilities.CVE-2026-53613 · Other software · util-linux · reported by GitHubHigh 7
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.
- Product
- util-linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026util-linux is a random collection of Linux utilities.CVE-2026-53612 · Other software · util-linux · reported by GitHubHigh 7
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.
- Product
- util-linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal netCVE-2026-25946 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 5.3
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or returnCVE-2026-15176 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supCVE-2026-110650 · Other software · anshulkharb · reported by VulnCheckCritical 9.3
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
- Product
- thumbnail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.CVE-2026-110649 · Other software · shahkashani · reported by VulnCheckCritical 9.3
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
- Product
- stills
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files wiCVE-2026-110648 · Other software · adamarcanov · reported by VulnCheckHigh 8.5
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
- Product
- compress-fonts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted namCVE-2026-110647 · Other software · jinghaihan · reported by VulnCheckHigh 8.5
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
- Product
- turnpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the reCVE-2026-110646 · Other software · beganovich · reported by VulnCheckCritical 9.2
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
- Product
- snappdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated uCVE-2026-110645 · Other software · ArsalanDotMe · reported by VulnCheckCritical 9.3
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
- Product
- video-stitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying craftedCVE-2026-110644 · Other software · ChetanXpro · reported by VulnCheckCritical 9.3
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
- Product
- nodejs-whisper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values toCVE-2026-110643 · Other software · kky-ykk · reported by VulnCheckCritical 9.3
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
- Product
- transcribe2texts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescapeCVE-2026-110642 · Other software · xhtml2pdf · reported by VulnCheckHigh 8.5
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
- Product
- xhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archivCVE-2026-110641 · Other software · runnerty · reported by VulnCheckHigh 8.7
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
- Product
- @runnerty/executor-decompress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptiCVE-2026-110640 · Other software · ariym · reported by VulnCheckCritical 9.3
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
- Product
- whisper-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archiCVE-2026-110639 · Other software · mborne · reported by VulnCheckCritical 9.3
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
- Product
- @mborne/extract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() CVE-2026-110638 · Other software · zepspaiva · reported by VulnCheckCritical 9.3
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
- Product
- doc-recog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB fCVE-2026-110637 · Other software · wastemobile · reported by VulnCheckHigh 8.5
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
- Product
- buildebooks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from callCVE-2026-110636 · Other software · revolunet · reported by VulnCheckCritical 9.3
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
- Product
- pypdftk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enaCVE-2026-110635 · Other software · scionoftech · reported by VulnCheckCritical 9.3
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
- Product
- webp-converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiffCVE-2026-110634 · Other software · danday74 · reported by VulnCheckCritical 9.3
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
- Product
- git-diff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install aCVE-2026-110633 · Other software · Report One · reported by VulnCheckHigh 8.5
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
- Product
- MyReport Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.commyreport.fr
Oct 14, 2026Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater bCVE-2026-110632 · Other software · Report One · reported by VulnCheckCritical 9.2
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
- Product
- MyReport Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.commyreport.fr
Oct 14, 2026Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core bCVE-2026-110631 · Other software · moghtech · reported by VulnCheckCritical 9.3
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
- Product
- komodo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unCVE-2026-110630 · Other software · venturedrake · reported by VulnCheckHigh 7
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through LCVE-2026-110629 · Other software · venturedrake · reported by VulnCheckHigh 7.1
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
- Product
- laravel-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix foCVE-2026-110628 · Other software · kanbn · reported by VulnCheckCritical 9.2
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
- Product
- kan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the vaCVE-2026-110627 · Other software · MacWarrior · reported by VulnCheckLow 2.1
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GETCVE-2026-110626 · Other software · MacWarrior · reported by VulnCheckMedium 5.1
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.CVE-2026-110625 · Other software · MacWarrior · reported by VulnCheckMedium 5.1
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by suCVE-2026-110624 · Other software · papermerge · reported by VulnCheckLow 2.3
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documCVE-2026-110623 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page managCVE-2026-110622 · Other software · papermerge · reported by VulnCheckHigh 7.7
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
- Product
- papermerge-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary prCVE-2026-110621 · Other software · Swetrix · reported by VulnCheckHigh 8.7
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
- Product
- swetrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resoCVE-2026-110620 · Other software · formbricks · reported by VulnCheckMedium 6.1
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
- Product
- formbricks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because hCVE-2026-110619 · Other software · fatedier · reported by VulnCheckMedium 6.3
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frpc admin listeners to obtain cmdline, goroutine stacks, heap profiles, and trigger CPU profiling.
- Product
- frp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke CVE-2026-110618 · Other software · pppscn · reported by VulnCheckHigh 8.6
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
- Product
- SmsForwarder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers toCVE-2026-110617 · Other software · rachelos · reported by VulnCheckMedium 6.3
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
- Product
- we-mp-rss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the CVE-2026-110616 · Other software · nullclaw · reported by VulnCheckCritical 9.2
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
- Product
- NullHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to chaCVE-2026-110615 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via CVE-2026-110614 · Other software · Yiuman · reported by VulnCheckHigh 7.1
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
- Product
- citrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app CVE-2026-110613 · Other software · youlaitech · reported by VulnCheckHigh 7.1
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
- Product
- youlai-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key inCVE-2026-110612 · Other software · wwwlike · reported by VulnCheckCritical 9.3
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
- Product
- vlife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifyinCVE-2026-110611 · Other software · getrebuild · reported by VulnCheckMedium 6
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
- Product
- rebuild
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make CVE-2026-110610 · Other software · YunaiV · reported by VulnCheckMedium 5.3
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword CVE-2026-110609 · Other software · dromara · reported by VulnCheckHigh 7.1
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques.
- Product
- skyeye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that alCVE-2026-110608 · Other software · BizSpring · reported by VulnCheckMedium 5.3
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
- Product
- BizSpring Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling CVE-2026-110607 · Other software · BizSpring · reported by VulnCheckHigh 7.1
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
- Product
- BizSpring Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by CVE-2026-110606 · Other software · LibreCAD · reported by VulnCheckMedium 4.8
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.
- Product
- libdxfrw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.