Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,215 results · page 4 of 765
Oct 27, 2026Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76938 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76937 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76936 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76935 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76934 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76933 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.CVE-2026-76932 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
- Product
- JP1/Automatic Job Management System 3 - Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order CVE-2026-102789 · Other software · balbooa.com · reported by security@joomla.orgCritical 9.3
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
- Product
- Gridbox extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is reCVE-2026-102788 · Other software · balbooa.com · reported by security@joomla.orgCritical 9.3
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
- Product
- Gridbox extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Qode Membership: Authentication Bypass leading to Account TakeoverCVE-2026-92885 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_re
- Product
- Qode Membership
- Affected
- up to 2.0.6.2
- What to do
- Affects up to 2.0.6.2. Update Qode Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 27, 2026The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.CVE-2026-18450 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Critical 9.8
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- Product
- X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DCVE-2026-116747 · Other software · rajnandan1 · reported by VulnCheckCritical 9.2
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
- Product
- kener
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104.CVE-2026-116508 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- A950RG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 26, 2026Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtaiCVE-2026-110720 · Other software · HashiCorp · reported by security@hashicorp.comCritical 9.9
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to CVE-2026-10757 · Other software · Esri · reported by psirt@esri.comCritical 9.8
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator.CVE-2026-102649 · Other software · padok-team · reported by GitHubCritical 9.9
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, ex
- Product
- burrito
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026zip is a zip library for Rust that supports reading and writing simple ZIP files.CVE-2026-115905 · Other software · zip-rs · reported by GitHubCritical 10
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
- Product
- zip2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace lauCVE-2026-112346 · Other software · OpenHands · reported by VulnCheckCritical 9.3
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
- Product
- OpenHands Software Agent SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0CVE-2026-93328 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 9.3
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
- Product
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group.CVE-2026-77055 · Other software · boneIO · reported by cvd@cert.plCritical 9.3
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
- Product
- black_debian_images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` witCVE-2026-65184 · Other software · Vertiv · reported by 44488dab-36db-4358-99f9-bc116477f914Critical 9.8
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
- Product
- Avocent ACS8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrunzero.comrunzero.com
Oct 26, 2026SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login PageCVE-2026-31158 · Other software · reported by MITRECritical 9.8
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Oct 26, 2026A security vulnerability has been identified in the vSolution Matrix file sharing feature.CVE-2026-59107 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.2
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.
- Product
- Cynap Pro, Cynap Core Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been identified in the WolfProt interface implementation.CVE-2026-59106 · Other software · WolfVision · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.3
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.
- Product
- Cynap Pure (Next Gen), Cynap Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when thCVE-2026-116485 · Other software · huangxd- · reported by VulnCheckCritical 9.3
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
- Product
- danmu_api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because chCVE-2026-116214 · Other software · maccmspro · reported by VulnCheckCritical 9.3
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificaCVE-2026-115693 · Other software · benoitc · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbCritical 9.1
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.
- Product
- hackney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.CVE-2026-115188 · Other software · reported by security@mautic.orgCritical 9.9
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service.CVE-2026-110475 · Other software · CreditNirvana · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
- Product
- CreditNirvana Collections Platform (CollectionWorkz)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSCVE-2026-107656 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
- Product
- FortiSandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 26, 2026NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.CVE-2026-107092 · Other software · reported by MITRECritical 9.8
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google CVE-2026-116199 · Other software · grokability · reported by VulnCheckCritical 9.2
Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methoCVE-2026-116163 · Other software · parse-community · reported by VulnCheckCritical 9.1
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026Datawiza Proxy Auth: Does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxyCVE-2026-115214 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
- Product
- Datawiza Proxy Auth
- Fixed in
- 1.1.1
- What to do
- Update Datawiza Proxy Auth to 1.1.1 or newer.
Oct 24, 2026A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4.CVE-2026-115995 · Other software · Unitree Robotics · reported by VulDBCritical 9.4
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
- Product
- Unitree Go2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunitree-firmware.oss-cn-hangzhou.aliyuncs.comvuldb.com
Oct 24, 2026Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).CVE-2026-114820 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients ru
- Product
- Oracle Java SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.CVE-2026-115933 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Critical 9.9
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Oct 24, 2026Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.CVE-2026-115557 · Other software · Python Software Foundation · reported by cna@python.orgCritical 9.4
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comemudhra.we-have-a-problem.com
Oct 24, 2026When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside tCVE-2026-115932 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Critical 9.6
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Oct 24, 2026open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structuCVE-2026-116014 · Other software · open62541 · reported by VulnCheckCritical 9.2
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.
- Product
- open62541
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Newsletters: Deserialization of Untrusted DataCVE-2026-94075 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
- Product
- Newsletters
- Affected
- up to 4.18.1
- What to do
- Affects up to 4.18.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Paytium: Deserialization of Untrusted DataCVE-2026-114196 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
- Product
- Paytium
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112866 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
- Product
- Product Filter by WBW
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-111402 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
- Product
- Newsletters
- Affected
- up to 4.18.1
- What to do
- Affects up to 4.18.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026asVereinbase: Does not require a valid password or a genuine second factor before authenticating a userCVE-2026-110956 · WordPress plugins & themes · reported by WPScanCritical 9.8
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
- Product
- asVereinbase
- Fixed in
- 1.1.8
- What to do
- Update asVereinbase to 1.1.8 or newer.
Oct 24, 2026Prime Mover – Backup and Migration: PHP Object InjectionCVE-2026-115806 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
- Product
- Prime Mover – Backup and Migration
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Prime Mover – Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2026Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.CVE-2026-115931 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Critical 9.9
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Oct 23, 2026Wasmtime is a runtime for WebAssembly.CVE-2026-115893 · Other software · bytecodealliance · reported by GitHubCritical 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Wasmtime is a runtime for WebAssembly.CVE-2026-115889 · Other software · bytecodealliance · reported by GitHubCritical 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrCVE-2026-115812 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
- Product
- multi-model-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.