Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,538 results · page 6 of 351
Oct 26, 2026There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted reqCVE-2026-33521 · Other software · Esri · reported by psirt@esri.comHigh 7.5
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to CVE-2026-33520 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokCVE-2026-116634 · Other software · cheaper-inference · reported by VulnCheckHigh 8.2
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
- Product
- OmniRoute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a CCVE-2026-105626 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by suCVE-2026-116543 · Other software · open5gs · reported by VulnCheckHigh 8.7
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
- Product
- open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NCVE-2026-116542 · Other software · netty · reported by VulnCheckMedium 6.9
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
- Product
- netty-tcnative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace lauCVE-2026-112346 · Other software · OpenHands · reported by VulnCheckCritical 9.3
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
- Product
- OpenHands Software Agent SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when thCVE-2026-116485 · Other software · huangxd- · reported by VulnCheckCritical 9.3
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
- Product
- danmu_api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers tCVE-2026-116217 · Other software · francoisjacquet · reported by VulnCheckMedium 5.3
RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.
- Product
- rosariosis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mCVE-2026-116216 · Other software · maccmspro · reported by VulnCheckMedium 6.9
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because chCVE-2026-116214 · Other software · maccmspro · reported by VulnCheckCritical 9.3
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attackerCVE-2026-115269 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Bandit.HTTP2.Stream.do_read_data/4 in lib/bandit/http2/stream.ex waits for each frame with a fresh read_timeout. A stream WINDOW_UPDATE, or the zero-delta window update that every empty SETTINGS frame delivers to all streams, ends the wait without delivering any body data, and the loop starts a new full countdown. A client that sends one of these 9-byte frames before each countdown expires keeps read_body blocked, together with the stream process and whatever the application holds while reading, for as long as it likes. This issue affects bandit: from 1.4.0 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacCVE-2026-114213 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks max_fragmented_message_size against the payload bytes received, but keeps every non-final continuation frame as a new list cell around its own binary, and nothing limits the number of fragments. A 1-byte fragment costs 7 bytes on the wire but about 150 to 170 bytes of server memory, so one connection can hold about 150 times the configured limit, roughly 1.2 to 1.4 GB at the default 8 MB. Ping frames between fragments keep the connection alive past the idle timeout. This issue affects bandit: from 1.11.0 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU CVE-2026-113436 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse_integer/2 in lib/bandit/headers.ex builds the number one digit at a time with no limit on the digit count, allocating a new bignum at each step, so one value costs time quadratic in its length. It runs on raw request input over HTTP/1 and HTTP/2, before any range check. Over HTTP/2, a 4,000-digit value can be stored once in the HPACK dynamic table and re-sent on each new stream for about one byte: 124 KB of traffic kept the server busy for 27.9 s. This issue affects bandit: from 1.0.0-pre.7 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection reCVE-2026-111103 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError partway through a chunk, Bandit.HTTP2.Handler.handle_data/3 sends RST_STREAM and continues with the connection state from before the chunk, dropping the rest of it. Streams opened by earlier frames in the chunk keep running their Plug calls, but the stream counts, last_stream_id, the rapid-reset timestamps, the HPACK decoder state and the buffer roll back, so max_concurrent_streams, max_requests and the rapid-reset limiter never see those streams. A client that sends one HEADERS frame more than max_concurrent_streams in each write has the extra refused and the others forgotten: with a limit of 10, five such writes run 50 Plug calls at once. This issue affects bandit: from 1.9.0 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attackCVE-2026-111101 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps every chunk as its own list cell and binary term until IO.iodata_to_binary/1 joins them, and nothing limits the number of chunks. The :length option of read_body/2 counts only data bytes, so tiny chunks cost far more memory than their payload: 48 MB of 1-byte chunks grew one handler process to about 500 MB and took about 6 s of CPU. The route does not need to read the body, because on keep-alive connections ensure_completed/1 drains unread bodies through the same reader. This issue affects bandit: from 0.1.0 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to gCVE-2026-110499 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit resizes its HPACK encoder table to whatever size the client advertises, up to 2^32-1 bytes, and indexes response headers into it. Because responses carry distinct values such as date or content-length, nothing is evicted and the table grows with every response for the life of the connection, while each lookup scans it linearly. The SETTINGS handling in Bandit.HTTP2.Connection (lib/bandit/http2/connection.ex) passes remote_settings.header_table_size to HPAX.resize/2 with no server-side cap, and encode_headers encodes every response header as :store. Serving N responses on one connection therefore costs O(N²) CPU in the connection process. This issue affects bandit: from 0.3.6 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote aCVE-2026-109584 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic table and then references it tens of thousands of times with 1-byte indexed fields. In the reporter's run, a 49 KB block made a server with default settings allocate a 183 MB cookie binary before any application code ran, and every concurrent stream can repeat the cost. Bandit.HTTP2.Connection caps only the compressed block (max_header_block_size), and its check of the decoded list against max_header_list_size never fires because that setting defaults to :infinity. combine_cookie_crumbs/1 in lib/bandit/http2/stream.ex then joins every crumb into one binary. This issue affects bandit: from 0.3.3 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU CVE-2026-108529 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked sends. In the reporter's run, with 3,000 blocked streams a single 9-byte SETTINGS frame took 133 ms to process. do_pending_sends/2 in lib/bandit/http2/connection.ex retries every queued send and, before each retry, removes that entry from the queue with List.delete/2, so one frame costs O(n²) list operations for n blocked streams. max_concurrent_streams defaults to :infinity, so the attacker chooses n. This issue affects bandit: from 0.3.4 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 26, 2026Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to eCVE-2026-108525 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops reading, then floods small DATA frames on that stream. Every frame is queued in the stream's mailbox until the BEAM node runs out of memory. Bandit.HTTP2.Connection.handle_frame/3 in lib/bandit/http2/connection.ex forwards each DATA frame to the stream process without consulting the receive window, and Bandit.HTTP2.FlowControl.compute_recv_window/2 replenishes the window as data arrives rather than as it is consumed, and never answers a violation with FLOW_CONTROL_ERROR. This issue affects bandit: from 0.3.1 before 1.14.0.
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 25, 2026YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest()CVE-2026-116207 · Other software · YesWiki · reported by VulnCheckHigh 8.8
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|CVE-2026-116205 · Other software · YesWiki · reported by VulnCheckMedium 6.9
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attaCVE-2026-116204 · Other software · YesWiki · reported by VulnCheckHigh 7.2
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sendCVE-2026-116193 · Other software · rclone · reported by VulnCheckMedium 6.9
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.
- Product
- rclone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backenCVE-2026-116192 · Other software · rclone · reported by VulnCheckHigh 8.2
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.
- Product
- rclone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an CVE-2026-116191 · Other software · rclone · reported by VulnCheckHigh 8.7
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
- Product
- rclone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor questioCVE-2026-116183 · Other software · thorsten · reported by VulnCheckHigh 8.7
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the NCVE-2026-116177 · Other software · vllm-project · reported by VulnCheckHigh 8.7
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.locCVE-2026-116167 · Other software · siyuan-note · reported by VulnCheckHigh 7.6
SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking kernel APIs to read or modify workspace content and settings.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 25, 2026Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and ovCVE-2026-116070 · Other software · dqzboy · reported by VulnCheckMedium 6.9
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
- Product
- Docker-Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addreCVE-2026-116069 · Other software · Albert-Weasker · reported by VulnCheckMedium 6.9
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
- Product
- niubigeo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated atCVE-2026-116067 · Other software · ananthakumaran · reported by VulnCheckHigh 8.8
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
- Product
- paisa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09.CVE-2026-116007 · Other software · YunaiV · reported by VulDBLow 2.9
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 25, 2026A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09.CVE-2026-116006 · Other software · YunaiV · reported by VulDBMedium 5.5
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 24, 2026yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sendingCVE-2026-116016 · Other software · YunaiV · reported by VulnCheckHigh 7.1
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other CVE-2026-116015 · Other software · YunaiV · reported by VulnCheckMedium 5.3
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by senCVE-2026-116011 · Other software · CrowCpp · reported by VulnCheckHigh 8.7
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
- Product
- Crow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript thCVE-2026-93638 · Email & office · Zimbra · reported by cve@rapid7.comMedium 6.1
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriCVE-2026-93630 · Email & office · Zimbra · reported by cve@rapid7.comMedium 4.3
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed tCVE-2026-93629 · Email & office · Zimbra · reported by cve@rapid7.comMedium 5.3
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another CVE-2026-93628 · Email & office · Zimbra · reported by cve@rapid7.comMedium 5.3
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modCVE-2026-93627 · Email & office · Zimbra · reported by cve@rapid7.comMedium 5.3
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended fCVE-2026-50053 · Email & office · Zimbra · reported by cve@rapid7.comHigh 8.7
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attCVE-2026-105963 · Other software · elixir-plug · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 5.1
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward. Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. R
- Product
- plug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 23, 2026Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling tCVE-2026-93489 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.7
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass passwCVE-2026-63244 · Other software · WizLearn Technologies Pte. Ltd. · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.8
An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.
- Product
- Learning Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
- Product
- Popup Builder
- Fixed in
- 4.4.6
- What to do
- Update Popup Builder to 4.4.6 or newer.
Oct 22, 2026A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attaCVE-2026-19678 · Other software · onPhase · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fHigh 8.7
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
- Product
- onPhase Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrevvo-docs.atlassian.netfrevvo-docs.atlassian.net
Oct 22, 2026An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticateCVE-2026-19677 · Other software · onPhase · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fCritical 9.3
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
- Product
- onPhase Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrevvo-docs.atlassian.netfrevvo-docs.atlassian.net
Oct 22, 2026Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.CVE-2026-97785 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Entra application proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.