Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,341 results · page 68 of 767
Aug 26, 2026A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command InjecCVE-2026-77554 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 10
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.
- Product
- UniFi Talk Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escaCVE-2026-77553 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a CVE-2026-77552 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.8
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.
- Product
- UniFi Enterprise Audio/Video Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display CVE-2026-77551 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.
- Product
- UniFi Connect Display Cast Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS CVE-2026-77550 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 10
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certCVE-2026-77549 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to eCVE-2026-77548 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCVE-2026-77547 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCVE-2026-77546 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Unrestricted File Type UploadCVE-2026-18080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
- Product
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Affected
- up to 1.17.8
- What to do
- Affects up to 1.17.8. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 26, 2026TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header.CVE-2026-80349 · Other software · TarsCloud · reported by VulnCheckCritical 9.3
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the X-Forwarded-For header supplied by the caller. In midware/ssoMidware.js a single branch covers both the ignored-path list and the ignoreIps allowlist from config/loginConf.js, which contains the loopback address, and that branch assigns the effective account identity from the uid query parameter before falling through to the request without validating any ticket, cookie or password. A request carrying a forged X-Forwarded-For value naming the loopback address and a uid naming an existing account therefore reaches every route the console mounts as that account, including an administrator, with no credential of any kind. Those routes include user and role administration, service configuration, and package upload and deployment. Version 3.0.16 separates the two branches so that a match on the address allowlist assigns the configured default account rather than one named by the caller.
- Product
- TarsWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain deviCVE-2026-77545 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCVE-2026-77543 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execuCVE-2026-77542 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.
- Product
- UID Enterprise Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to esCVE-2026-77541 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a CVE-2026-77540 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a CVE-2026-77539 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command InCVE-2026-77537 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 10
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OSCVE-2026-77536 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to CVE-2026-77535 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OSCVE-2026-77534 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682).CVE-2026-59683 · Other software · CalcProgrammer1 · reported by meissner@suse.deCritical 9.3
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).
- Product
- OpenRGB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgitlab.com
Aug 26, 2026EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability.CVE-2026-80235 · Other software · Thinking Software Technology · reported by twcert@cert.org.twCritical 9.3
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- EFence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to eCVE-2026-77533 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Avada: Arbitrary File WriteCVE-2026-18431 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.
- Product
- Avada
- Affected
- up to 7.16
- What to do
- Affects up to 7.16. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordavada.comwordfence.com
Aug 26, 2026Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write accCVE-2026-15203 · Other software · Danfoss · reported by d7ff35af-cf88-454c-bab9-af60602f10f8Critical 9.3
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms
- Product
- iC7-Automation SP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.danfoss.comassets.danfoss.com
Aug 26, 2026Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheeCVE-2026-80202 · Other software · kimai · reported by VulnCheckCritical 9.3
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)
- Product
- kimai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 26, 2026TranslatePress – Translate Multilingual sites with AI Translation: Sensitive Information ExposureCVE-2026-19632 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
- Product
- TranslatePress – Translate Multilingual sites with AI Translation
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution.CVE-2026-80138 · Other software · MacWarrior · reported by VulnCheckCritical 9.2
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106.CVE-2026-79911 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- N600R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing.CVE-2026-16645 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing.CVE-2026-16644 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Commerce Elavon.CVE-2026-16641 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass.CVE-2026-16639 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge CVE-2026-78655 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record in the session, raising it on each rejected code and deleting the pending record once it reaches attempts, five by default. Punk::Session carries the session in a signed cookie unless the application declares a store, and keeps no server-side record, so an earlier value of the same session stays valid until the expiry stamped inside it. A client that saves the cookie before its failed attempts and presents it again gets the pending record back with its counter, and the limit never fires. The replayed record is accepted while its own expiry, pending_ttl seconds from the challenge and 300 by default, has not passed. Sessions declared with a store are not affected: the pending record and its counter then live server-side. The attempt limit does not bound guessing of the second factor, which is left to the per-address rate limit the plugin registers on the same path, 30 requests per 60 secon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user idenCVE-2026-78619 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended. The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Aug 25, 2026Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access tCVE-2026-68525 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 25, 2026Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator.CVE-2026-65905 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 25, 2026Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.CVE-2026-65637 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specifiCVE-2026-65182 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 25, 2026Typebot is an open-source chatbot builder.CVE-2026-62862 · Other software · baptisteArno · reported by GitHubCritical 9.1
Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secure token with a 6-digit code generated using Math.random(), reducing the keyspace to 900,000 with a 10-minute expiry, and the code itself is the raw value placed in the magic link. The verification callback enforces no attempt limit, lockout, or CSRF protection, and an incorrect guess does not consume the real code because the adapter returns null on a not-found token, so a valid code survives unlimited guessing within its lifetime. The only rate limiter applies to the code-sending path and is keyed on the client-controlled X-Forwarded-For header, allowing an attacker to request many concurrent live codes for one victim and further raise the odds of a matching guess. As a result, an anonymous attacker who knows a victim's email address can brute-force the callback and obtain an authenticated session as that user with no victim interaction, gaining full access to the victim's bots, results, a
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory.CVE-2026-80104 · Other software · eosphoros-ai · reported by VulnCheckCritical 9.3
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.
- Product
- DB-GPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.CVE-2026-79290 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafCVE-2026-79282 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.CVE-2026-79275 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.CVE-2026-79257 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.CVE-2026-79235 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craftedCVE-2026-79232 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.CVE-2026-79200 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cCVE-2026-79189 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.