Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,210 results · page 37 of 585
Sep 22, 2026Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode.CVE-2026-87079 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character at a time. The scan runs once per code point over the output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same quadratic cost. Nothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any length to the decoder.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode.CVE-2026-87078 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_pCVE-2026-74766 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.4
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation. Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected. Decoding an attacker-supplied punycode label reads and writes freed heap memory.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.CVE-2026-74765 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API. Only the XS backend is affected. Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Sep 22, 2026Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode.CVE-2016-15059 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-84990 · Other software · ntop · reported by GitHubHigh 8.8
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-83621 · Other software · ntop · reported by GitHubHigh 8.1
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026ntopng is a web-based network traffic monitoring application.CVE-2026-82412 · Other software · ntop · reported by GitHubHigh 8.8
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionalitCVE-2026-36469 · Other software · reported by MITRECritical 9.1
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design.CVE-2026-55071 · Other software · SepineTam · reported by GitHubHigh 8.4
MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.
- Product
- mcp-for-stata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.CVE-2026-94401 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 8.3
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47
- Product
- MISP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes secuCVE-2026-92574 · Other software · Red Hat · reported by Red HatHigh 8.8
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.
- Product
- Confidential Compute Attestation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 20, 2026A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94101 · Other software · Netcore · reported by VulDBHigh 8.6
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A weakness has been identified in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94100 · Other software · Netcore · reported by VulDBHigh 8.6
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94099 · Other software · Netcore · reported by VulDBHigh 8.6
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERY_STRING results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94098 · Other software · Netcore · reported by VulDBHigh 8.5
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94097 · Other software · Netcore · reported by VulDBCritical 9.3
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A vulnerability was found in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94096 · Other software · Netcore · reported by VulDBHigh 8.6
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 20, 2026A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246.CVE-2026-94095 · Other software · Netcore · reported by VulDBHigh 8.6
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NBR200V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapp.notion.comvuldb.com
Sep 18, 2026A flaw was found in Netty's `netty-codec-http` component.CVE-2026-93574 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026A flaw was found in Netty's HTTP/1 decoder.CVE-2026-93562 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-71855 · Other software · OISF · reported by GitHubMedium 5.9
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-71418 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63452 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63451 · Other software · OISF · reported by GitHubLow 3.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63450 · Other software · OISF · reported by GitHubLow 3.7
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63449 · Other software · OISF · reported by GitHubLow 3.7
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63448 · Other software · OISF · reported by GitHubMedium 5.9
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63447 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-63446 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57229 · Other software · OISF · reported by GitHubMedium 5.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57228 · Other software · OISF · reported by GitHubHigh 8.2
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57227 · Other software · OISF · reported by GitHubHigh 7.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57225 · Other software · OISF · reported by GitHubLow 3.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57223 · Other software · OISF · reported by GitHubHigh 7
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57226 · Other software · OISF · reported by GitHubLow 3.7
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57224 · Other software · OISF · reported by GitHubMedium 6.5
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.CVE-2026-57222 · Other software · OISF · reported by GitHubMedium 5.3
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both, causing incorrect detection state. This issue is fixed in versions 8.0.6 and 7.0.17.
- Product
- suricata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper vaCVE-2026-18869 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.
- Product
- i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious inCVE-2019-25776 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckHigh 8.7
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.CVE-2026-64847 · Other software · agronholm · reported by GitHubMedium 6.8
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.
- Product
- anyio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A flaw was found in Netty's HTTP/2 stack.CVE-2026-93579 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
- Product
- Red Hat Build of Debezium 3.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 18, 2026Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain CVE-2026-93338 · Other software · Grandstream Networks · reported by VulnCheckMedium 6.9
Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive system information by querying the SNMP v2c service configured with the default community string 'public'. Attackers can query standard MIBs over the SNMP port to retrieve operating system and kernel version, running process names and command-line arguments, network interface configuration, routing table entries, ARP table mappings, active TCP connection details, and file system paths, enabling detailed reconnaissance of the device and adjacent network infrastructure.
- Product
- GWN7660ELR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirmware.grandstream.comgrandstream.com
Sep 18, 2026CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem.CVE-2026-81321 · Other software · CareCam · reported by ics-cert@hq.dhs.govCritical 9.3
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.CVE-2026-63349 · Other software · agronholm · reported by GitHubHigh 7
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.
- Product
- anyio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61795 · Other software · projectcapsule · reported by GitHubMedium 6.8
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61794 · Other software · projectcapsule · reported by GitHubMedium 6.8
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Capsule is a multi-tenancy and policy-based framework for Kubernetes.CVE-2026-61672 · Other software · projectcapsule · reported by GitHubHigh 7.1
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
- Product
- capsule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service.CVE-2026-88259 · Other software · CareCam · reported by ics-cert@hq.dhs.govHigh 8.7
CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service.CVE-2026-84400 · Other software · CareCam · reported by ics-cert@hq.dhs.govLow 2.3
CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of unauthorized administrative access.
- Product
- HMT.CM2507 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.