Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

16,541 results · page 4 of 331

Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rustCVE-2026-98938 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory. Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields are initialized. This is not needed in mainline because commit 98c63ce4d760 ("rust: irq: make Registration compatible with lifetime-bound drivers") removed Devres from irq::Registration and moved request_irq() after all fields are initialized.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org
Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currCVE-2026-98937 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Oct 23, 2026Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalkCVE-2026-115752 · Other software · SignalK · reported by VulnCheckLow 2.3
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Product
signalk-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts dCVE-2026-115751 · Other software · agentfront · reported by VulnCheckMedium 6.3
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.
Product
mcp-from-openapi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value startiCVE-2026-115730 · Other software · i18next · reported by VulnCheckLow 2.3
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Product
i18next-http-backend
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getCVE-2026-115729 · Other software · pdfme · reported by VulnCheckHigh 8.9
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
Product
common
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request beforeCVE-2026-98889 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check. Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Oct 23, 2026Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling tCVE-2026-93489 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.7
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Product
Router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Oct 23, 2026Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow aCVE-2026-75779 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.6
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Product
Router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asus.com
Oct 23, 2026Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO: Does not verify that the requester is authorised to edit the targeted user account in the update-user action of its CVE-2026-94262 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.
Product
Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO
Fixed in
0.9.2.8
What to do
Update Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO to 0.9.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Product
Popup Builder
Fixed in
4.4.6
What to do
Update Popup Builder to 4.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attaCVE-2026-19678 · Other software · onPhase · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fHigh 8.7
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Product
onPhase Forms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record frevvo-docs.atlassian.net frevvo-docs.atlassian.net
Oct 22, 2026The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations.CVE-2026-110491 · Other software · Kiloview · reported by ics-cert@hq.dhs.govMedium 6.9
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.
Product
E3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 22, 2026The ONVIF device service on the E3 responds to certain informational requests without requiring authentication.CVE-2026-111100 · Other software · Kiloview · reported by ics-cert@hq.dhs.govMedium 6.9
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks.
Product
E3 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Oct 22, 2026Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.CVE-2026-108456 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
Product
Azure AI Foundry
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 22, 2026A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgerCVE-2026-79880 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.7
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Product
ArubaOS (AOS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Oct 22, 2026OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies CVE-2026-115359 · Other software · openbao · reported by VulnCheckMedium 6.3
OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.
Product
openbao
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 22, 2026libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration CVE-2026-114655 · Other software · MongoDB · reported by cna@mongodb.comMedium 6
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Product
libmongocrypt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attaCVE-2026-115494 · Other software · KNIME · reported by security@knime.comMedium 5.3
A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.
Product
KNIME Business Hub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record knime.com
Oct 22, 2026crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges sCVE-2026-115411 · Other software · crawlseo · reported by VulnCheckMedium 5.3
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.
Product
crawlseo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Oct 22, 2026QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authentiCVE-2026-115326 · Other software · Webkul · reported by VulnCheckMedium 5.3
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Product
QloApps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 22, 2026Xpro Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2026-114177 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.
Product
Xpro Elementor Addons
Affected
up to 1.7.10
What to do
Affects up to 1.7.10. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Product
MasterStudy LMS
Fixed in
3.7.55
What to do
Update MasterStudy LMS to 3.7.55 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migrationCVE-2026-110010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.3
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026FluentCart A New Era of eCommerce: Does not verify that a stored customer address selected during checkout belongs to the requesterCVE-2026-100142 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Product
FluentCart A New Era of eCommerce
Fixed in
2.2.0
What to do
Update FluentCart A New Era of eCommerce to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.CVE-2026-114730 · Websites & servers · Roundcube · reported by MITREHigh 7.2
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org github.com
Oct 21, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery.CVE-2026-96388 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery.CVE-2026-96374 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery.CVE-2026-96370 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery.CVE-2026-87953 · Websites & servers · reported by mlhess@drupal.orgLow 3.3
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 21, 2026Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: NegotiatCVE-2026-114639 · Other software · traefik · reported by VulnCheckHigh 7
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
Product
traefik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 21, 2026Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.CVE-2026-114635 · Other software · traefik · reported by VulnCheckHigh 7
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
Product
traefik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 21, 2026WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects wiCVE-2026-114634 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endCVE-2026-76290 · Other software · Splunk · reported by psirt@cisco.comHigh 7.5
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com
Oct 21, 2026In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScripCVE-2026-76288 · Other software · Splunk · reported by psirt@cisco.comHigh 7.5
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisory.splunk.com
Oct 21, 2026Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestCVE-2026-112921 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.3
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com metacpan.org
Oct 21, 2026Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being CVE-2026-112381 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.CVE-2026-111812 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many sucCVE-2026-111810 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.CVE-2026-111809 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.9
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directlyCVE-2026-78119 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 6.3
The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIV_ROUND_UP(len, 4) words into struct espi_taf_pckt.src, a fixed 16-word (64-byte) member of a static structure, without ever comparing the length against that buffer or against the negotiated eSPI receive payload size (rx-plsize, 64 bytes on all in-tree NPCX/NPCK SoCs). Both the loop counter and the word count were uint8_t, so the copy ran up to 255 iterations. An eSPI controller that emits a flash request whose header claims a payload larger than the negotiated maximum therefore drives up to 239 32-bit stores past the end of the structure — roughly 956 bytes of out-of-bounds write into .bss — from the eSPI flash receive interrupt handler, while the source reads walk past the end of the 18-word FLASHRXBUF register array into neighbouring eSPI registers. The same unvalidated length was then passed on to flash_write() in espi_taf_npcx_flash_write() with the 64-byte src buffer as source, reading up to 4 KB of adjacent controller SRAM
Product
zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026Tailored Tools: Cross-Site Request Forgery (CSRF)CVE-2026-111401 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3.
Product
Tailored Tools
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock.CVE-2026-110803 · Other software · vaadin · reported by security@vaadin.comHigh 8.7
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin Framework 8.16.0 - 8.32.1 Mitigation Upgrade to 8.32.2 Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin-ser
Product
framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vaadin.com
Oct 21, 2026When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxCVE-2026-105942 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.7
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check. First, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all r
Product
Apache Pulsar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org pulsar.apache.org
Oct 21, 2026Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fullyCVE-2025-31699 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org
Oct 21, 2026NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability.CVE-2026-92210 · Other software · NoMachine · reported by zdi-disclosures@trendmicro.comHigh 7.2
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.
Product
NoMachine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Oct 21, 2026Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.CVE-2026-92204 · Other software · Airbyte · reported by zdi-disclosures@trendmicro.comHigh 7.7
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.
Product
Airbyte
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Oct 21, 2026Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.CVE-2026-92203 · Other software · Airbyte · reported by zdi-disclosures@trendmicro.comHigh 7.7
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.
Product
Airbyte
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com
Oct 21, 2026LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URCVE-2026-114493 · Other software · LocalAI · reported by VulnCheckCritical 9.2
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Product
LocalAI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browserCVE-2026-114470 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 5.3
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.
Product
hMailServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.