Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
333,778 results · page 47 of 6676
Nov 9, 2026A weakness has been identified in PipraPay 3.0.0.CVE-2026-124624 · Other software · reported by VulDBMedium 5.5
A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Privilege escalation in the Reader View component in Firefox for iOS.CVE-2026-121842 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 9, 2026Other issue in Firefox for iOS.CVE-2026-121841 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 9, 2026pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wCVE-2026-119743 · Other software · bpampuch · reported by VulnCheckMedium 6.3
pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy.
- Product
- pdfmake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSSCVE-2026-119274 · Other software · Infoblox · reported by f84ca5ce-fbe7-4668-8724-994599108a02Medium 4.8
Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS
- Product
- NIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research InstitCVE-2026-94434 · Other software · TÜBİTAK BİLGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 8.8
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.
- Product
- Pardus Boot Repair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A security flaw has been discovered in PipraPay 3.0.0.CVE-2026-124623 · Other software · reported by VulDBLow 2
A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3.CVE-2026-124622 · Other software · olivier-ls · reported by VulDBMedium 4.8
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
- Product
- PHP-FTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attaCVE-2026-124079 · Other software · rConfig · reported by VulnCheckCritical 9.3
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address.
- Product
- rConfig Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026ShopEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-122673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
- Product
- ShopEngine
- Affected
- up to 4.9.8
- What to do
- Affects up to 4.9.8. Update ShopEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026A flaw was found in GStreamer's gst-plugins-bad package.CVE-2026-121611 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 9, 2026A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad).CVE-2026-121601 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 9, 2026iubenda: Allocation of Resources Without Limits or ThrottlingCVE-2026-120854 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.
- Product
- iubenda
- Affected
- up to 3.13.6
- What to do
- Affects up to 3.13.6. Update iubenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error detailsCVE-2026-119613 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller. This issue affects ash_ai: from 1.5.0 before 1.5.1.
- Product
- ash_ai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 9, 2026A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element.CVE-2026-119610 · Other software · Red Hat · reported by Red HatHigh 8.2
A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 9, 2026Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through appCVE-2026-118798 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.4
Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.
- Product
- Wingesfar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.CVE-2026-118795 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.9
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Default credentials permit access through AcuXDBC.CVE-2026-118792 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.1
Default credentials permit access through AcuXDBC.
- Product
- Wingesfar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted withoutCVE-2026-118791 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.2
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
- Product
- Wingesfar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Multiple hardcoded credentials are embedded within product components and administrative functionalities.CVE-2026-118790 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.2
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
- Product
- Wingesfar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality.CVE-2026-112205 · Other software · Fundacja Widzialni · reported by cvd@cert.plMedium 6.9
WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in version 2.5.
- Product
- WidzialniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint.CVE-2026-112204 · Other software · Fundacja Widzialni · reported by cvd@cert.plMedium 5.1
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.
- Product
- WidzialniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data.CVE-2026-112171 · Other software · GALENO SISTEMI · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.4
An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data.
- Product
- MAGISTRA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.CVE-2026-112170 · Other software · GALENO SISTEMI · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.3
The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.
- Product
- MAGISTRA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credentiaCVE-2026-112169 · Other software · GALENO SISTEMI · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.1
Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification.
- Product
- MAGISTRA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.CVE-2026-112168 · Other software · GALENO SISTEMI · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6
The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.
- Product
- MAGISTRA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint.CVE-2026-110469 · Other software · Fundacja Widzialni · reported by cvd@cert.plCritical 10
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
- Product
- WidzialniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint.CVE-2026-110468 · Other software · Fundacja Widzialni · reported by cvd@cert.plCritical 10
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.
- Product
- WidzialniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character pointer remains in use.CVE-2026-124684 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.1
This issue can cause a heap-use-after-free when an embedder unloads a ReloadableString buffer while a previously returned raw character pointer remains in use. Successful triggering may cause the Escargot-based process to crash, resulting in a denial of service.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS).CVE-2026-121629 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 9, 2026XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity CVE-2026-118468 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.2
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseCVE-2026-118467 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.3
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.CVE-2026-118465 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.8
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, conCVE-2026-118464 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.8
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums.CVE-2026-118462 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.2
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.CVE-2026-118461 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized pCVE-2026-118460 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.CVE-2026-118459 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.3
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- Product
- Infantia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accCVE-2026-118458 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.1
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
- Product
- Phronesis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.CVE-2026-118450 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 5.9
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
- Product
- Venere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queriCVE-2026-112172 · Other software · CompuGroup Medical · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.1
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
- Product
- XDent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885.CVE-2026-124621 · Other software · kongxin-github · reported by VulDBLow 2.1
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Java_Library_Management_System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A vulnerability was detected in Bahleel 0.1.0/0.1.1.CVE-2026-124591 · Other software · reported by VulDBMedium 5.1
A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00CVE-2026-124590 · Other software · zhangbw409 · reported by VulDBMedium 5.5
A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- library_manager_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2026Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java.CVE-2026-123779 · Email & office · Apache Software Foundation · reported by security@apache.org
Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxis.apache.orggithub.com
Nov 9, 2026Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java.CVE-2026-123770 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxis.apache.orggithub.com
Nov 9, 2026Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java.CVE-2026-123766 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxis.apache.orggithub.com
Nov 9, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java.CVE-2026-123753 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaxis.apache.orggithub.com
Nov 9, 2026MapSVG: Missing AuthorizationCVE-2026-123475 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.
- Product
- MapSVG
- Affected
- up to 8.16.3
- What to do
- Affects up to 8.16.3. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2026Formidable Forms Signature Online Contract Automation: Missing AuthorizationCVE-2026-121722 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract Automation: from n/a through 2.0.5.
- Product
- Formidable Forms Signature Online Contract Automation
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Formidable Forms Signature Online Contract Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.