Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,544 results · page 40 of 351
Sep 19, 2026Metasync: Unauthorized modification of dataCVE-2026-15947 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
- Product
- Metasync
- Affected
- up to 2.6.23
- What to do
- Affects up to 2.6.23. Update Metasync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Online Scheduling and Appointment Booking System: Does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actionsCVE-2026-91847 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
- Product
- Online Scheduling and Appointment Booking System
- Fixed in
- 28.2
- What to do
- Update Online Scheduling and Appointment Booking System to 28.2 or newer.
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.5
- What to do
- Update Estatik Real Estate to 4.3.5 or newer.
Sep 18, 2026Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.CVE-2026-88097 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register CVE-2026-93839 · Other software · ModelTC · reported by VulnCheckCritical 9.3
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.
- Product
- LightLLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls anCVE-2026-82967 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change AudCVE-2026-82340 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted CVE-2026-81657 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of changCVE-2026-80441 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.
- Product
- Guardium Data Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary fileCVE-2017-20284 · Other software · Caucho Technology, Inc. · reported by VulnCheckHigh 8.7
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.
- Product
- Resin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblkstone.github.iocaucho.com
Sep 18, 2026Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GECVE-2021-48008 · Other software · Chanjet Information Technology Co., Ltd. · reported by VulnCheckHigh 8.7
Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comchanjet.com
Sep 18, 2026Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious inCVE-2019-25776 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckHigh 8.7
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to causCVE-2026-93761 · Other software · MongoDB Inc. · reported by cna@mongodb.comHigh 8.7
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
- Product
- Mongoid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticateCVE-2026-93748 · Other software · kornelski · reported by VulnCheckHigh 8.7
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
- Product
- http-cache-semantics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain CVE-2026-93338 · Other software · Grandstream Networks · reported by VulnCheckMedium 6.9
Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive system information by querying the SNMP v2c service configured with the default community string 'public'. Attackers can query standard MIBs over the SNMP port to retrieve operating system and kernel version, running process names and command-line arguments, network interface configuration, routing table entries, ARP table mappings, active TCP connection details, and file system paths, enabling detailed reconnaissance of the device and adjacent network infrastructure.
- Product
- GWN7660ELR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirmware.grandstream.comgrandstream.com
Sep 18, 2026vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crCVE-2026-93592 · Other software · vllm-project · reported by VulnCheckHigh 8.7
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 18, 2026HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IPCVE-2026-56597 · Other software · HCL Software · reported by psirt@hcl.comLow 3.1
HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.
- Product
- HCL BigFix Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 18, 2026HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthentiCVE-2026-56590 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.
- Product
- HCL BigFix Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 18, 2026HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized aCVE-2026-67102 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.1
HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.
- Product
- HCL BigFix Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Sep 18, 2026Easy Appointments: Does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied idCVE-2026-87966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
- Product
- Easy Appointments
- Fixed in
- 4.0.2.2
- What to do
- Update Easy Appointments to 4.0.2.2 or newer.
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87775 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Tz Weekly Radio Schedule
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87774 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Tz Weekly Radio Schedule
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Product Question and Answer: Does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated usersCVE-2026-87771 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Product Question and Answer
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Product Question and Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Price Drop Alert for Woo Commerce: Does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87770 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- Price Drop Alert for Woo Commerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Price Drop Alert for Woo Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026wp shortcut link and advertisement baner: Does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87767 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
- Product
- wp shortcut link and advertisement baner
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update wp shortcut link and advertisement baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026VikBooking Hotel Booking Engine & PMS: Does not restrict the type of files unauthenticated visitors may attach to its live chatCVE-2026-85127 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.8.15
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.8.15 or newer.
Sep 17, 2026SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recCVE-2026-93453 · Other software · Alinto · reported by VulnCheckHigh 8.7
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a CVE-2026-83946 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
- Product
- Azure Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69843 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62874 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Billing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85917 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85889 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Foundry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.CVE-2026-83944 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to CVE-2026-78501 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot's Business Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.CVE-2026-77903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Dataverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a CVE-2026-70200 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networkCVE-2026-70009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Container Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.CVE-2026-68791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Machine Learning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-55946 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Motors – Car Dealership & Classified Listings: Unauthorized access of dataCVE-2026-16750 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
- Product
- Motors – Car Dealership & Classified Listings
- Affected
- up to 1.4.120
- What to do
- Affects up to 1.4.120. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized modification of dataCVE-2026-16582 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2026Booking for Appointments and Events Calendar – Amelia: Unauthorized access and modification of dataCVE-2026-14311 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where the Employee Panel is present.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() uncCVE-2026-90202 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() unconditionally frees every ioc->pcie_sg_lookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability.CVE-2026-28326 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.8
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
- Product
- Access Rights Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comdocumentation.solarwinds.com
Sep 17, 2026HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to CVE-2026-92984 · Other software · hubzero · reported by VulnCheckHigh 8.5
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
- Product
- hubzero-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability.CVE-2026-80356 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- OpenManage Server Administrator Managed Node (Patch) for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackeCVE-2026-92972 · Other software · sgl-project · reported by VulnCheckHigh 8.8
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.
- Product
- sglang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to teCVE-2026-92971 · Other software · InternLM · reported by VulnCheckHigh 8.7
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
- Product
- lmdeploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.CVE-2026-90986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.
- Affected
- up to 11.21
- What to do
- Affects up to 11.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.