Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,577 results · page 65 of 352
Aug 21, 2026There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a CVE-2026-69228 · Other software · Esri · reported by psirt@esri.comMedium 5.3
There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacCVE-2026-69225 · Other software · Esri · reported by psirt@esri.comMedium 5.9
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.CVE-2026-64679 · Other software · runatlantis · reported by GitHubHigh 8.1
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.
- Product
- atlantis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconCVE-2026-76876 · Other software · puemos · reported by VulnCheckHigh 8.2
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.
- Product
- craftplan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file CVE-2026-67361 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderCVE-2026-67359 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unautCVE-2026-75928 · Other software · Brushfire · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.
- Product
- Online Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.brushfire.comraw.githubusercontent.com
Aug 21, 2026Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69502 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure SQL Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.CVE-2026-77806 · Other software · SPIP · reported by MITRECritical 9.8
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
- Product
- SPIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spip.netgithub.com
Aug 21, 2026Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied fielCVE-2026-76612 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.CVE-2026-76611 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verificatioCVE-2026-15576 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 6.9
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.CVE-2026-66797 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.CVE-2026-65613 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.CVE-2026-61397 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.CVE-2026-59780 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles. This issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.CVE-2026-59655 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.CVE-2026-50222 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpointsCVE-2026-16575 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.14
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.14 or newer.
Aug 21, 2026NewPath WildApricotPress Add-on: Does not enforce its members-only field privacy on an unauthenticated REST routeCVE-2026-13736 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.
- Product
- NewPath WildApricotPress Add-on
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update NewPath WildApricotPress Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticatedCVE-2026-76157 · Other software · Datiphy Inc. · reported by ART@zuso.aiHigh 8.8
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
- Product
- Data Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.CVE-2026-77647 · Other software · SPIP · reported by MITRECritical 9.8
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.
- Product
- SPIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spip.netlists.debian.org
Aug 20, 2026Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-70105 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.CVE-2026-69836 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Entra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.CVE-2026-69558 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Partner Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-69555 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure ARC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.CVE-2026-69519 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Stack HCI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a CVE-2026-69400 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-66800 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.6
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Web Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.CVE-2026-65801 · Email & office · Microsoft · reported by secure@microsoft.comCritical 10
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attackeCVE-2026-65770 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
- Product
- Azure Managed Instance for Apache Cassandra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure Data Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in coCVE-2026-19446 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.
- Product
- AIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NULCVE-2026-75484 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6.9
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read_headers/1 validates pseudo-header placement and uniqueness, header-name casing, connection-specific headers, the te value, and content-length, but never checks field values. Because HPACK carries arbitrary octets, a HEADERS block whose field values contain \r, \n, or \0 decodes without error and the values land in conn.req_headers unchanged. The HTTP/1 path already rejects the same octets; HTTP/2 did not. Bandit itself is not a sink for the injected bytes: its own logging uses fixed strings or inspect, and HTTP/2 response headers are HPACK-encoded and separately rejected by Plug's put_resp_header, so response splitting is not reachable through this path. The risk is entirely in how a downstream application consumes header values, such as appending one verbatim to a plain-text log or concatenating it into an upstream request. A related gap bundled in the same fix: only :method, :scheme, and :path were checked for at most one occurrence;
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 20, 2026Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTCVE-2026-74836 · Other software · mtrudel · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level send window (default 65,535 bytes, shared across all streams on the connection), Bandit.HTTP2.Connection queues the remaining bytes and a reply closure in pending_sends and the stream process blocks forever inside a synchronous call to the connection process. Nothing bounds that wait and nothing purges the queue: a client RST_STREAM for the blocked stream is delivered to its mailbox but never read while it is stuck inside the call, so cancelling frees nothing, and periodic PING frames keep the transport-level read timeout from ever firing. The equivalent block on the stream-level send window is already bounded at 15 seconds; the connection-level path had no such bound. Each stalled stream pins its process, Plug state, and any resource the Plug holds across the blocked write, such as a pooled upstream connection in a reverse-proxy Plug. The attacker chooses any endpoint whose response exceeds
- Product
- bandit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Aug 20, 2026A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any applicCVE-2026-43798 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.
- Product
- swift-nio-ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcCVE-2026-9033 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
- Product
- ER7212PC v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomadanetworks.comomadanetworks.com
Aug 20, 2026An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSCVE-2026-43678 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
- Product
- swift-nio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.CVE-2026-74021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.CVE-2026-74020 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-73993 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
- Affected
- up to 1.7.9
- What to do
- Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-68564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- Affected
- up to 10.4.0
- What to do
- Affects up to 10.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.CVE-2026-66680 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
- Affected
- up to 3.9.72
- What to do
- Affects up to 3.9.72. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-66673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.