Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31,419 results · page 6 of 629
Oct 27, 2026Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name pCVE-2013-20009 · Network & remote access · Linksys · reported by VulnCheckMedium 4.8
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
- Product
- WAG200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.coms3cur1ty.de
Oct 27, 2026Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the curreCVE-2013-20008 · Network & remote access · Linksys · reported by VulnCheckHigh 7
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
- Product
- WAG200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.coms3cur1ty.de
Oct 27, 2026Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delCVE-2013-20007 · Network & remote access · Linksys · reported by VulnCheckHigh 8.6
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
- Product
- WAG200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.coms3cur1ty.de
Oct 27, 2026The private keys of eight eMudhra intermediate CA certificates have been compromised.CVE-2026-22063 · Other software · NetApp · reported by security-alert@netapp.comMedium 6
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
- Product
- ONTAP 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations withCVE-2026-115413 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7.3
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.
- Product
- aws-api-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Oct 27, 2026The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have tCVE-2026-82986 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.6
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
- Product
- Tables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can triggCVE-2026-113775 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Oct 27, 2026Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for CVE-2026-108015 · Other software · HCLSoftware · reported by psirt@hcl.comCritical 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
- Product
- Notes Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 27, 2026Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for CVE-2026-108014 · Other software · HCLSoftware · reported by psirt@hcl.comCritical 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
- Product
- Domino Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 27, 2026Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote CodCVE-2026-78845 · Other software · reported by MITRECritical 9.8
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release verCVE-2026-94347 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- Product
- PowerProtect Data Domain Virtual Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release verCVE-2026-94346 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- Product
- PowerProtect Data Domain Virtual Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90727 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90726 · Other software · Dell · reported by security_alert@emc.comMedium 6
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90725 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 thCVE-2026-68866 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly ConstraineCVE-2026-16307 · Other software · Netiket Information Technologies · reported by iletisim@usom.gov.trMedium 4.3
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
- Product
- EdoWEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into CVE-2026-117573 · Other software · masc-ucsc · reported by VulnCheckHigh 8.5
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
- Product
- hagent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blockedCVE-2026-117570 · Other software · Vorota-ai · reported by VulnCheckMedium 4.8
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
- Product
- nmap-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run CVE-2026-117569 · Other software · alishahid74 · reported by VulnCheckHigh 8.5
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
- Product
- kali-gpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir CVE-2026-117568 · Other software · bitscorp-mcp · reported by VulnCheckHigh 7.3
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
- Product
- mcp-ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters CVE-2026-117567 · Other software · horw · reported by VulnCheckHigh 8.5
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
- Product
- esp-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files oCVE-2026-117566 · Other software · icret · reported by VulnCheckMedium 6.9
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload extensions from the server.
- Product
- EasyImages2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' CVE-2026-117563 · Other software · zmister2016 · reported by VulnCheckMedium 5.3
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable share tokens from the MD5 of document ID and username to re-enable disabled shares or remove access codes, exposing private documents.
- Product
- MrDoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through tCVE-2026-117562 · Other software · anyant · reported by VulnCheckMedium 6.9
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
- Product
- rssant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLCVE-2026-117561 · Other software · codefriar · reported by VulnCheckHigh 8.5
Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.
- Product
- sf-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsaCVE-2026-117560 · Other software · atxp · reported by VulnCheckHigh 8.5
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.
- Product
- gemini-cli-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick subCVE-2026-117559 · Other software · hyperb1iss · reported by VulnCheckHigh 8.5
DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.
- Product
- droidmind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metachaCVE-2026-117558 · Other software · ai-sdlc-framework · reported by VulnCheckHigh 8.5
The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.
- Product
- ai-sdlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count valiCVE-2026-117557 · Other software · libsdl-org · reported by VulnCheckMedium 6.9
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
- Product
- SDL_image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count.CVE-2026-117555 · Other software · GreycLab · reported by VulnCheckMedium 6.9
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
- Product
- CImg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions CVE-2026-90732 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90731 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90730 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90729 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-90728 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1CVE-2026-56084 · Other software · Dell · reported by security_alert@emc.comMedium 5.8
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
- Product
- PowerProtect Data Domain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are CVE-2026-113644 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.5
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands (`edgelet provision` and `edgelet config cert` on supported releases; `iofog-agent provision` and `iofog-agent cert` on older releases) that run over SSH on a remote agent host and via a local shell. A party who can change that API response can include shell metacharacters and cause the operator's CLI to run additional commands on the agent host when the operator deploys or attaches an agent. This is fixed in version 3.9.2.
- Product
- Eclipse ioFog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML withoutCVE-2026-117541 · Other software · darylldoyle · reported by VulnCheckMedium 6.9
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
- Product
- svg-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup throughCVE-2026-116892 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 5.3
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through CVE-2026-116889 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 5.3
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup CVE-2026-116888 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 4.8
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through KCVE-2026-116887 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 5.3
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via ExCVE-2026-116886 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 5.3
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through CVE-2026-116883 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 4.8
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to forceCVE-2026-116879 · Other software · SemanticMediaWiki · reported by VulnCheckMedium 6.9
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.
- Product
- SemanticMediaWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmittCVE-2026-101034 · Other software · Broadcom · reported by secure@symantec.comMedium 6.8
An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.
- Product
- Symantec Ghost Solution Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default.CVE-2026-110910 · Other software · ljharb · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158Medium 6.3
### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short. ### Details In `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + '[]'` early, before the code that passes every other key through `encoder` and `formatter`. So `{ "x&k=v": ["1"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ "x&k=v": [] }` serializes as `x&k=v[]`. The early return applies at any depth (`{ "a": { "b&k=v": [] } }` gives `a[b&k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected. #### PoC ```js var qs = require("qs"); var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true }); // "q=hi&x&apiKey=evil&y[]" qs.parse(quer
- Product
- qs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device CVE-2026-106174 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 27, 2026Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path.CVE-2026-117472 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 4.3
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An authenticated remote attacker with an unusual read-disabled, write-enabled API key could therefore retrieve encrypted secret data and nonces through the prefixed bulk-secret-read endpoint despite lacking read permission. The default configuration without URL_PREFIX was not affected.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.