Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,461 results · page 4 of 50
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106488 · Other software · backstage · reported by GitHubHigh 8.1
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106487 · Other software · backstage · reported by GitHubLow 3.5
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106486 · Other software · backstage · reported by GitHubHigh 8.5
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106463 · Other software · backstage · reported by GitHubMedium 5.4
Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106462 · Other software · backstage · reported by GitHubMedium 6.4
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106461 · Other software · backstage · reported by GitHubMedium 4.3
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106460 · Other software · backstage · reported by GitHubMedium 6.8
Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106459 · Other software · backstage · reported by GitHubHigh 8.5
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106458 · Other software · backstage · reported by GitHubMedium 6.5
Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106457 · Other software · backstage · reported by GitHubMedium 6.8
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106456 · Other software · backstage · reported by GitHubMedium 4.8
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Backstage is an open framework for building developer portals.CVE-2026-106455 · Other software · backstage · reported by GitHubHigh 7.7
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5.
- Product
- backstage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026WeasyPrint helps web developers to create PDF documents.CVE-2026-106443 · Other software · Kozea · reported by GitHubHigh 8.8
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.
- Product
- WeasyPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Dify is an open-source LLM app development platform.CVE-2026-105762 · Other software · langgenius · reported by GitHubHigh 8.3
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.
- Product
- dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Dify is an open-source LLM app development platform.CVE-2026-105761 · Other software · langgenius · reported by GitHubHigh 7.1
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.
- Product
- dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026Filament is a collection of full-stack components for accelerated Laravel development.CVE-2026-104181 · Other software · filamentphp · reported by GitHubMedium 5.4
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.
- Product
- filament
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026djehuty is a research data repository system developed by 4TU.ResearchData.CVE-2026-73976 · Other software · 4TUResearchData · reported by GitHubHigh 7.1
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.
- Product
- djehuty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026djehuty is a research data repository system developed by 4TU.ResearchData.CVE-2026-73975 · Other software · 4TUResearchData · reported by GitHubHigh 8.4
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.
- Product
- djehuty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configurationCVE-2026-103475 · Other software · yii2-starter-kit · reported by VulnCheckCritical 9.3
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS.CVE-2026-55176 · Other software · Soft-Machine-io · reported by GitHubCritical 9
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment inside each workspace, any tenant can use it to authenticate to any other tenant's workspace API. The result is cross-workspace read, write, and destructive-restore primitives reachable from any paying customer's shell. The existing per-workspace token check (workspaceTokenMatches) protects the user-facing per-workspace token path, but the shared-secret bearer path bypasses it entirely. At time of publication, there are no publicly known patches.
- Product
- security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS.CVE-2026-46711 · Other software · Soft-Machine-io · reported by GitHubHigh 8.3
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.
- Product
- security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit.CVE-2026-76992 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.7
The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity.
- Product
- Development System 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability.CVE-2026-102459 · Other software · DigiWin · reported by twcert@cert.org.twMedium 5.1
EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability.CVE-2026-102458 · Other software · DigiWin · reported by twcert@cert.org.twCritical 9.3
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability.CVE-2026-102457 · Other software · DigiWin · reported by twcert@cert.org.twHigh 7.1
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability.CVE-2026-102456 · Other software · DigiWin · reported by twcert@cert.org.twHigh 7.1
EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability.CVE-2026-102455 · Other software · DigiWin · reported by twcert@cert.org.twCritical 9.3
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability.CVE-2026-102454 · Other software · DigiWin · reported by twcert@cert.org.twHigh 8.6
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- EasyFlow .NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 30, 2026Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog nodeCVE-2026-92873 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 6.9
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.CVE-2026-92872 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 5.3
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.CVE-2026-92871 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.CVE-2026-92870 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.CVE-2026-92869 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 7.1
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.CVE-2026-92868 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpMedium 6.9
An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code exeCVE-2026-92867 · Other software · Pgpool Global Development Group · reported by vultures@jpcert.or.jpHigh 8.7
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.
- Product
- Pgpool-II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allCVE-2026-102811 · Other software · rochacbruno · reported by VulnCheckHigh 8.7
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.
- Product
- marmite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitraCVE-2026-102810 · Other software · rochacbruno · reported by VulnCheckHigh 8.7
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.
- Product
- marmite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption.CVE-2026-82936 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 5.9
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware.CVE-2026-82935 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.9
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device. Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP.CVE-2026-82933 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module does not load any firewall rules at startup.CVE-2026-82932 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 5.3
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authenticCVE-2026-82930 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.4
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation.CVE-2026-82929 · Other software · F&F Filipowski · reported by cvd@cert.plMedium 6.3
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor.CVE-2026-82928 · Other software · F&F Filipowski · reported by cvd@cert.plHigh 7.7
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30
- Product
- mH-DEVELOPER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2026GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules.CVE-2026-100689 · Other software · gitpython-developers · reported by VulnCheckHigh 8.7
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
- Product
- GitPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 24, 2026ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.CVE-2026-81508 · Other software · espressif · reported by GitHubMedium 4.3
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability.CVE-2026-97181 · Other software · ezGlobal · reported by twcert@cert.org.twMedium 6.9
GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.
- Product
- GPM LIGHT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 23, 2026If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extensioCVE-2026-96276 · Other software · Red Hat · reported by Red HatMedium 6.5
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 23, 2026CGServiSign developed by Changing has a OS Command Injection vulnerability.CVE-2026-15027 · Other software · Changing · reported by twcert@cert.org.twHigh 8.6
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.
- Product
- CGServiSign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 22, 2026ReactPress is a publishing system for React developers.CVE-2026-61685 · Other software · fecommunity · reported by GitHubHigh 7.5
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
- Product
- reactpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.