Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,189 results · page 64 of 304
Jan 13, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22861 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Prior to 2.3.1.2, There is a heap-based buffer overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp. This vulnerability affects users of the iccDEV library who process ICC color profiles. The vulnerability is fixed in 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service.CVE-2026-21301 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Modeler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service.CVE-2026-21300 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Modeler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22818 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-22817 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service.CVE-2026-21288 · Other software · Adobe · reported by AdobeMedium 5.5
Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Illustrator Desktop 2026
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platformCVE-2025-25176 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceCritical 9.1
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping CVE-2026-0510 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3
The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.
- Product
- NW AS Java UME User Mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access aCVE-2026-0507 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.4
Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability.
- Product
- SAP Application Server for ABAP and SAP NetWeaver RFCSDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execuCVE-2026-0506 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information.CVE-2026-0497 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidentiality, with no impact on integrity or availability of the application.
- Product
- Business Server Pages Application (Product Designer Web UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricCVE-2026-0494 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.
- Product
- SAP Fiori App (Intercompany Balance Reconciliation)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.CVE-2026-22801 · Other software · pnggroup · reported by GitHubMedium 6.8
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
- Product
- libpng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.CVE-2026-22695 · Other software · pnggroup · reported by GitHubMedium 6.1
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.
- Product
- libpng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway.CVE-2026-22771 · Other software · envoyproxy · reported by GitHubHigh 8.8
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communicate with the control plane and gain access to all secrets that are used by Envoy proxy, e.g. TLS private keys and credentials used for downstream and upstream communication. This vulnerability is fixed in 1.5.7 and 1.6.2.
- Product
- gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jan 12, 2026IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access aCVE-2025-41077 · Other software · Viafirma · reported by cve-coordination@incibe.esHigh 8.6
IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.
- Product
- Inbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-22610 · Other software · angular · reported by GitHubHigh 8.5
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of CVE-2026-22194 · Other software · GestSup · reported by VulnCheckHigh 8.9
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
- Product
- GestSup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgestsup.frvulncheck.com
Jan 9, 2026In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized aCVE-2025-66744 · Other software · reported by MITREHigh 7.5
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashesCVE-2025-67279 · Other software · Tim-solutions · reported by MITREMedium 5.3
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format
- Product
- TIM Flow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtim-doc.atlassian.nety-security.de
Jan 9, 2026Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.CVE-2026-20972 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.8
Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jan 8, 2026Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.CVE-2025-15464 · Other software · yintibao · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 7.5
Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.
- Product
- Fun Print Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comseclists.org
Jan 8, 2026Werkzeug is a comprehensive WSGI web application library.CVE-2026-21860 · Other software · pallets · reported by GitHubMedium 6.3
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
- Product
- werkzeug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22255 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.CVE-2026-21876 · Other software · coreruleset · reported by GitHubCritical 9.3
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
- Product
- coreruleset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication.CVE-2026-0719 · Other software · Red Hat · reported by Red HatHigh 8.6
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 7, 2026NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files froCVE-2019-25268 · Other software · NREL · reported by VulnCheckHigh 8.6
NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Attackers can exploit insecure library loading of sdl2.dll and libegl.dll by placing malicious libraries on WebDAV or SMB shares to execute unauthorized code.
- Product
- BEopt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comexchange.xforce.ibmcloud.com
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22047 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `SIccCalcOp::Describe()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-22046 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21693 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21692 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21691 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.4
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21690 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.3
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagData::ToXml()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21689 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.5
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21688 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21687 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagCurve::CIccTagCurve()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21686 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLutAtoB::Validate()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21685 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21684 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagSpectralViewingConditions()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21683 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible CVE-2025-12776 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Low 1.8
The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. The Report Builder is part of the WebConsole. The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.
- Product
- WebConsole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21682 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow in `CIccXmlArrayType::ParseText()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21681 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Undefined Behavior runtime error. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color managemCVE-2026-21680 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.5
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer dereference vulnerability. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21679 · Other software · InternationalColorConsortium · reported by GitHubHigh 8.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow in CIccLocalizedUnicode::GetText(). This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21678 · Other software · InternationalColorConsortium · reported by GitHubHigh 7.8
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow vulnerability in IccTagXml(). This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21506 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to Null pointer dereference in CIccProfileXml::ParseBasic(), leading to denial of service. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21505 · Other software · InternationalColorConsortium · reported by GitHubMedium 5.5
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to an invalid enum value. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21504 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.6
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap buffer overflow in the ToneMap parser. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-21503 · Other software · InternationalColorConsortium · reported by GitHubMedium 6.1
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to a null pointer passed to memcpy() in CIccTagSparseMatrixArray. This issue has been patched in version 2.3.1.2.
- Product
- iccDEV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.