Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,174 results · page 34 of 304
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-47422 · Other software · frappe · reported by GitHubMedium 5.3
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-47199 · Other software · frappe · reported by GitHubLow 2.3
Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-42219 · Other software · frappe · reported by GitHubMedium 6.9
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Frappe is a full-stack web application framework.CVE-2026-41482 · Other software · frappe · reported by GitHubHigh 7.1
Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026LangChain4j is a Java library for building LLM-powered applications on the JVM.CVE-2026-55405 · Other software · langchain4j · reported by GitHubHigh 7.6
LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can break out of its SQL context and inject arbitrary SQL into the statements executed by the stores' search and removeAll(Filter) operations, enabling blind data exfiltration, denial of service via sleep functions, and deletion of arbitrary rows through removeAll(Filter). This issue is fixed in langchain4j-mariadb and langchain4j-pgvector versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.
- Product
- langchain4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.CVE-2026-21055 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.5
Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.
- Product
- Bixby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.CVE-2026-21054 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data.
- Product
- InputSharing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.CVE-2026-21053 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox.
- Product
- Samsung Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 10, 2026Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.CVE-2026-21044 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.8
Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-55615 · Other software · langroid · reported by GitHubCritical 9.2
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query text is influenceable by prompt injection (direct user input or indirect content the agent reads back via RAG), so an attacker who can influence the prompt can read or destroy all graph data and, when APOC or dbms.security procedures are enabled on the server, achieve OS-command and filesystem access. This is the same defect class and threat model as the SQLChatAgent prompt-to-SQL-to-RCE issue fixed in version 0.63.0 (CVE-2026-25879); that fix did not extend to the neo4j module. Version 0.65.5 contains a fix for the neo4j module.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54771 · Other software · langroid · reported by GitHubHigh 8.1
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with `use=False, handle=True`. Version 0.65.3 fixes the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54769 · Other software · langroid · reported by GitHubCritical 10
Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an empty dictionary `{}` inside Python's `eval()` function. However, this relies on an incomplete understanding of Python's execution model. Because `__builtins__` is not explicitly scrubbed from the `globals` dictionary mapping, Python implicitly injects all built-ins during execution, granting full access to functions like `__import__('os').system()`. Since `TableChatAgent.pandas_eval()` executes external LLM outputs natively, this bypass permits any attacker providing prompt payload to achieve unauthenticated RCE on the host system. Version 0.65.2 patches the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-54760 · Other software · langroid · reported by GitHubCritical 9.3
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. The blocklist entries that target callable functions require the function name to be immediately followed by `\s*\(`. PostgreSQL accepts the same call with the name separated from `(` by a quoted identifier, an inline comment, or schema qualification. These forms evade the regex, still parse as `SELECT`, and execute the same PostgreSQL function. This restores the `pg_read_file` server-side file-read primitive that the prior CVE-2026-25879 / GHSA-pmch-g965-grmr fix was meant to block: the parent advisory fixed a missing `pg_read_file` blocklist entry, while this report shows that the added regex is bypassable. Version 0.65.1 fixes the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-50181 · Other software · langroid · reported by GitHubHigh 7.1
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operations. However, the tools only change the process working directory to `curr_dir` and then operate on the user-supplied `file_path` without resolving and enforcing that the final path remains inside `curr_dir`. As a result, a tool caller can supply path traversal sequences such as `../secret.txt` to read files outside the configured current directory, or `../written_by_tool.txt` to write files outside that directory. This can impact applications that expose Langroid file tools to an LLM agent, user-controlled tool call, or delegated coding/documentation agent while relying on `curr_dir` to restrict file access to a project/workspace directory. Version 0.64.0 patches the issue.
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Langroid is a framework for building large-language-model-powered applications.CVE-2026-50180 · Other software · langroid · reported by GitHubHigh 8.7
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth layer whose `_DANGEROUS_SQL_PATTERNS` regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family `pg_read_file()`, `pg_stat_file()`, `pg_ls_logdir()`, `pg_ls_waldir()`, `pg_current_logfile()` (and similar `SELECT`-shaped functions in the same family). It also leaves SQL Server `OPENDATASOURCE` and SQLite `ATTACH '<file>' AS x` (DATABASE keyword omitted) unblocked. An attacker able to shape the LLM's generated SQL (directly via prompt input or transitively via prompt-injection in data the LLM ingests) can read arbitrary files from the PostgreSQL host through ordinary `SELECT` queries, even with the agent's strict default configuration (`allow_dangerous_operations=False`, `allowed_statement_types=['SELECT']`). The payloads survive the statement-type allowlist (each is a `SELECT`) and pass through the regex blocklist (none of the function names match), then reach the live SQLAlchemy engine via `SQLChatAgent.run_query`. Ver
- Product
- langroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications.CVE-2026-55590 · Other software · cakephp · reported by GitHubMedium 5.1
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
- Product
- authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2026-59734 · Other software · coollabsio · reported by GitHubHigh 8.8
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers. This issue is fixed in version 4.0.0-beta.469.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews.CVE-2026-13462 · Other software · PayRange · reported by cret@cert.orgHigh 7.5
PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.
- Product
- PayRange
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgkb.cert.org
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59897 · Other software · honojs · reported by GitHubMedium 4.8
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59896 · Other software · honojs · reported by GitHubMedium 6.5
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-59895 · Other software · honojs · reported by GitHubMedium 6.1
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACVE-2026-55761 · Other software · portainer · reported by GitHubHigh 7.1
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.
- Product
- portainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the systeCVE-2026-3144 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbIdCVE-2026-10706 · Other software · Adalo No-Code App Builder · reported by cret@cert.orgHigh 7.5
In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.
- Product
- App Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between orgaCVE-2026-56293 · Other software · Capgo · reported by VulnCheckMedium 5.3
Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history records in the source organization or cause the destination organization to lose access to transferred application deployment records.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 8, 2026The application opened a PDF file containing an abnormal Unity 3D object.CVE-2026-57260 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form iCVE-2026-57256 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comtalosintelligence.com
Jul 8, 2026The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function.CVE-2026-57255 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel tCVE-2026-57252 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel to continue accessing invalid pointers, eventually leading to the application crashing.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks.CVE-2026-57251 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface.CVE-2026-57250 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the application does not perform validation. The function call on the damaged object leads to the application crashing.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action.CVE-2026-57249 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action. During the re-entry process, the application access invalid objects and crashed.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks.CVE-2026-57248 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash during subsequent release.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objects obtained before dCVE-2026-57247 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objects obtained before deletion, triggering an illegal read and crashing.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationshipsCVE-2026-57245 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The application opens the PDF, and JavaScript modifies the form.CVE-2026-57242 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose CVE-2026-57241 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the application to lose synchronization; however, the renderer still trusts the outdated page count, and eventually the application crashes due to out-of-bounds access.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointeCVE-2026-57240 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid pointer references and causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026After the application opened the PDF, JavaScript deleted the form field object.CVE-2026-57238 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program CVE-2026-57237 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form objecCVE-2026-13129 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026The application opens the PDF file.CVE-2026-13127 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. However, the thumbnails still use the invalid page objects, ultimately causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-54607 · Other software · labring · reported by GitHubHigh 7.7
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata. This issue is fixed in version 4.15.0-beta4.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026FastGPT is a knowledge-based AI application platform.CVE-2026-54602 · Other software · labring · reported by GitHubHigh 7.1
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.CVE-2026-49033 · Other software · Labcenter · reported by ics-cert@hq.dhs.govHigh 8.4
The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.
- Product
- Proteus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files.CVE-2026-42958 · Other software · Labcenter · reported by ics-cert@hq.dhs.govHigh 8.4
The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.
- Product
- Proteus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocatCVE-2026-42953 · Other software · Labcenter · reported by ics-cert@hq.dhs.govHigh 8.4
The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.
- Product
- Proteus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Actual is an open-source personal finance application.CVE-2026-50007 · Other software · actualbudget · reported by GitHubHigh 7.2
Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoints intended for higher-privilege users, including /delete-user-file, /reset-user-file, and /user-create-key, because requireFileAccess treats ordinary shared access as sufficient for file-management operations that should be restricted to the file owner or an administrator. This issue is fixed in version 26.7.0.
- Product
- actual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026A flaw was found in Jastow.CVE-2025-12799 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.
- Product
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 7, 2026Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.CVE-2026-42201 · Other software · coollabsio · reported by GitHubLow 3.3
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' at the API layer, with zero shell-safety checks. These values are then interpolated directly into Docker Compose YAML command: strings without any escaping. This issue is fixed in version 4.0.0-beta.474.
- Product
- coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.